±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 34187
New Yesterday: 1 Visitors: 116

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

RSS Feed Widget

±Latest Webinars

EFS File Encryption

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

EFS File Encryption

Post Posted: Wed Jul 11, 2018 11:46 am

Have a hard drive where the suspect used EFS file encryption for numerous folders and files. Operating system is Windows 10 and I have the user's password. What is the easiest way to recover the encrypted files? I do not have access to Encase which I know supports EFS.  

renfantino
Newbie
 
 
  

Re: EFS File Encryption

Post Posted: Thu Jul 12, 2018 7:36 am

Advanced EFS Data Recovery can do that:

www.elcomsoft.com/aefsdr.html  

v.katalov
Member
 
 
  

Re: EFS File Encryption

Post Posted: Thu Jul 12, 2018 11:53 am

Good ol' manual way (to be seen if needs to be adapted for more recent OS):
www.beginningtoseethel.../index.htm
It did work just fine on a Windows 10 machine (with EFS coming from an old XP install):
www.tenforums.com/anti...post787245
which should mean that the methods detailed still work.

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 

Page 1 of 1