mailing list archives
Re: Windows private folder option decryption
From: Moritz Naumann <info () moritz-naumann com>
Date: Thu, 09 Dec 2004 11:44:23 +0100
For a good read on encrypted file systems see
Elcomsoft (known for their work on cracking the adobe ebook encryption)
have a software for this. I never used it, though, so I can't say
whether it's good or not.
If I recall correctly, their are two weaknesses in Windows' Encrypted
File System (EFS):
- Decoding key hashes could be read from disk swap
- 56 bit encryption only
I assume the above software makes use of at least the first weakness,
maybe both. If any usable key hashes are found this would be a fast way
to recover the data. The second method would need brute forcing which
will take quite a while.