Re: Windows private folder option decryption

[Moritz Naumann <info () moritz-naumann com>]

Hey Jon!

For a good read on encrypted file systems see 
http://www.linuxexposed.com/internal.php?op=modload&name=News&file=article&sid=512

Elcomsoft (known for their work on cracking the adobe ebook encryption) 
have a software for this. I never used it, though, so I can't say 
whether it's good or not.
http://www.crackpassword.com/products/prs/mswin/efs/

If I recall correctly, their are two weaknesses in Windows' Encrypted 
File System (EFS):
- Decoding key hashes could be read from disk swap
- 56 bit encryption only

I assume the above software makes use of at least the first weakness, 
maybe both. If any usable key hashes are found this would be a fast way 
to recover the data. The second method would need brute forcing which 
will take quite a while.

Greetings,
Moritz Naumann

--
Moritz Naumann
Hamburg, Germany