Home page logo

basics logo Security Basics mailing list archives

Re: Windows private folder option decryption
From: Moritz Naumann <info () moritz-naumann com>
Date: Thu, 09 Dec 2004 11:44:23 +0100

Hey Jon!

For a good read on encrypted file systems see http://www.linuxexposed.com/internal.php?op=modload&name=News&file=article&sid=512

Elcomsoft (known for their work on cracking the adobe ebook encryption) have a software for this. I never used it, though, so I can't say whether it's good or not.

If I recall correctly, their are two weaknesses in Windows' Encrypted File System (EFS):
- Decoding key hashes could be read from disk swap
- 56 bit encryption only

I assume the above software makes use of at least the first weakness, maybe both. If any usable key hashes are found this would be a fast way to recover the data. The second method would need brute forcing which will take quite a while.

Moritz Naumann

Moritz Naumann
Hamburg, Germany

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]