Notifications
Clear all

EFS File Encryption

3 Posts
3 Users
0 Likes
1,088 Views
(@renfantino)
Posts: 9
Active Member
Topic starter
 

Have a hard drive where the suspect used EFS file encryption for numerous folders and files. Operating system is Windows 10 and I have the user's password. What is the easiest way to recover the encrypted files? I do not have access to Encase which I know supports EFS.

 
Posted : 11/07/2018 5:46 pm
(@v-katalov)
Posts: 52
Trusted Member
 

Advanced EFS Data Recovery can do that

https://www.elcomsoft.com/aefsdr.html

 
Posted : 12/07/2018 1:36 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Good ol' manual way (to be seen if needs to be adapted for more recent OS)
http//www.beginningtoseethelight.org/efsrecovery/index.htm
It did work just fine on a Windows 10 machine (with EFS coming from an old XP install)
https://www.tenforums.com/antivirus-firewalls-system-security/61276-how-open-efs-encrypted-files-hdd-came-windows-xp.html#post787245
which should mean that the methods detailed still work.

jaclaz

 
Posted : 12/07/2018 5:53 pm
Share: