RE: Stolen laptops and the Windows encrypted file system?

["Richard M. Smith" <rms () bsf-llc com>]

The EnCase product description is silent on how it gets encryption keys.
It's possible that it must be supplied with keys to do the decrypt. 

Richard 

-----Original Message-----
From: funsec-bounces () linuxbox org [mailto:funsec-bounces () linuxbox org] On
Behalf Of Young, Keith
Sent: Tuesday, March 28, 2006 1:02 PM
To: funsec () linuxbox org
Subject: RE: [funsec] Stolen laptops and the Windows encrypted file system?


> Is EFS only effective then against attackers who don't know about this
service?

Or thieves who only want to resell the laptop and not the data, yes.

Otherwise, for those people looking for data, EnCase will do a great job of
decrypting EFS and searching for specific info:
        http://www.encase.com/products/ef_AddOn.asp

--Keith

Keith Young, Security Official
Department of Technology Services
Montgomery County, Maryland
phone - (240) 777-2955

_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.

_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.