Hi, These excellent articles by Roberta Bragg detail the steps for Hacking EFS: 1) http://www.sans.org/newlook/digests/hacking_efs1.htm 2) http://www.sans.org/newlook/digests/hacking_efs2.htm
Also by the above author: http://www.infosecuritymag.com/articles/february01/features_applied_crypto.s html It may be information overkill, but anyway...other references: Encrypting File System (EFS) Resources http://www.labmice.net/Windows2000/FileMgmt/EFS.htm Encrypting File System Primer: Basics and Best Practices http://rr.sans.org/win2000/EFS_primer.php EFS for System Admins http://windows.2000trainers.com/coursesandarticles/reviews/efs.html EFS: Handle with Care http://mcpmag.com/columns/article.asp?EditorialsID=391 Recovering Encrypted Data (Note: You'll need to register to view the content.) http://www.8wire.com/article_render/?aid=1822 Windows 2000 Encrypting File System http://rr.sans.org/win2000/w2k_efs.php Regards, David [EMAIL PROTECTED] -----Original Message----- From: mightyscot . [mailto:[EMAIL PROTECTED]] Sent: May 21, 2002 12:43 PM To: [EMAIL PROTECTED] Subject: cracking Windows 2000 EFS Hi, I am hoping that someone can help me save all my personal documents that are encrypted with Windows 2000 EFS. I reinstalled my W2K without unencrypting my documents and I did not back up the key used to encrypt the documents. It was a standalone system so there is no Administrator with a recovery key to help. My account was the administrator which got formatted with the reinstall. I recovered the SAM file and tried replacing the newly installed system's SAM file with my old SAM file in the hopes that it would think I was the previous account and allow me to unencrypt my documents but W2K did not like the switch and wouldn't let me log in at all. Is there a way to unencypt my documents?? Is there a cracking program available or some other method? I have tried searching for *.cer files to recover the certificate used to encrypt the files but none existed. Thanks for any help, MS _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp.
