Notifications
Clear all

Carving EFS?

1 Posts
1 Users
0 Reactions
552 Views
(@adamd)
Eminent Member
Joined: 19 years ago
Posts: 46
Topic starter  

Has anyone played around with carving EFS data from unallocated? (NTFS)

I'm looking for deleted data I know was in an EFS area of the drive. Have the key, but need to find the data (f ? ile entries gone).

I'm about to do some testing on it anyway, but was wondering if anyone else has had to go down this route?

A lot of Internet history etc is kept in the efs areas of drives these days, would be great to be able to carve it out. Not sure how this would work with fragmented data either. Pagefile may yield something also.


   
Quote
Share: