EFS File Encryption

General (Technical, Procedural, Software, Hardware etc.)

Last Post by jaclaz 7 years ago

3 Posts

3 Users

0 Reactions

1,532 Views

RSS

renfantino

(@renfantino)

Active Member

Joined: 9 years ago

Posts: 9

Topic starter 11/07/2018 6:46 pm

Have a hard drive where the suspect used EFS file encryption for numerous folders and files. Operating system is Windows 10 and I have the user's password. What is the easiest way to recover the encrypted files? I do not have access to Encase which I know supports EFS.

Quote

v.katalov

(@v-katalov)

Trusted Member

Joined: 12 years ago

Posts: 52

12/07/2018 2:36 pm

Advanced EFS Data Recovery can do that

https://www.elcomsoft.com/aefsdr.html

ReplyQuote

jaclaz

(@jaclaz)

Illustrious Member

Joined: 18 years ago

Posts: 5133

12/07/2018 6:53 pm

Good ol' manual way (to be seen if needs to be adapted for more recent OS)
http//www.beginningtoseethelight.org/efsrecovery/index.htm
It did work just fine on a Windows 10 machine (with EFS coming from an old XP install)
https://www.tenforums.com/antivirus-firewalls-system-security/61276-how-open-efs-encrypted-files-hdd-came-windows-xp.html#post787245
which should mean that the methods detailed still work.

jaclaz

ReplyQuote