Re: Identifying Win2K/XP Encrypted Files

From: Craig Earnshaw <Craig.Earnshaw(at)TheEntrepreneur.com>
Date: Thu Jan 30 2003 - 08:13:11 EST

I would actually suggest a different method. If you are tasked to seize a machine you should do ABSOLUTELY NOTHING with it, apart from pulling the plug out of the wall if it's up and running. Any actions that you perform on the machine could potentially destroy evidence and subsequently be used to suggest that you have tampered with the evidence.

The best scenario for dealing with the Windows 2000 encrypted file system (EFS) is to seize the machine, image it with you imaging tool of choice (Safeback, EnCase, dd etc etc) and then restore the image onto a blank drive, replace the drive in the original machine with you new copy of the drive, and then boot using a Linux boot disk developed by Peter Nordahl (I think his name is) available from http://home.eunet.no/~pnordahl/ntpasswd/. This can be used to change the logon passwords for the users of the machine, and let you log into their accounts (there are some caveats to this, but they're set out on the site so I'm not going to duplicate them here). Once you're logged into the accounts you are able to access all files stored within an EFS.

Just my 2c - hope that it helps.

Regards

Craig G Earnshaw
Head of Forensic Computing Services
Lee & Allen Consulting Ltd
London - New York - Hong Kong

Christopher Howell wrote:

>Does anyone know a slick way to find encrypted files on a running Win2K/XP machine? If I am tasked with seizing one, and find it on and logged in, it would be nice to be able to identify files encrypted with Windows before I pull the plug. It seems to me the only way to do it is to view the attributes in Windows Explorer - but short of clicking down through the whole tree, I don't see how to find encrypted files that are in non-encrypted folders or a level or two down...

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Thu Jan 30 08:33:40 2003