General discussion


Microsoft's EFS (Encrypted File System)

By Mark Hackl ·
How to recover files that have been encrypted by EFS without the encryption key.

EFS is native to NTFS file system so if you can move the file off of the encrypted volume to that of say a FAT 16/32 volume the encrpytion will be stripped. EFS won't let you move the file thought. You have to move the file from a third-party 32bit system with admin rights (like NT workstation, 2000 server etc.)via the network.
Now in order to do this you have to remember to share the containing directory. Oncethe directory or file has been transfered to the FAT volume it can be imediatley transfered back to it's original location if so desired, and will now be accessable.

I'm sure that you could achieve the same results by physically relocating the drive containing the file to a NT machine with an FAT volume.

This conversation is currently closed to new comments.

0 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Back to Security Forum
0 total posts (Page 1 of 1)  

Related Discussions

Related Forums