Author Topic: Windows XP File Encryption (Read 3742 times)

Grey Ninja · « **on:** July 12, 2004, 06:21:32 PM »

I've been bad. I just reformatted, and in traditional form, I have forgotten to back up something very important. Namely, the encryption key to an encrypted folder.

*sigh*

So basically, I have just screwed myself. I only have one encrypted folder, but it's got a log file in it that is VERY important to me. (Which is why it was encrypted in the first place).

It would be very appreciated if anyone could help me out with this. I am not much of a hacker, be it white or black, and my only thought on the matter at the moment is coding a simple app to brute force hack the file, and wait a few months to read it. But I don't have enough knowledge of EFS to really do that right now, and I am sure that there is an existing app to do that anyways.

So PLEASE, if anyone knows how to break the encryption, reply, pm me, email me, whatever. Just please help me. It doesn't matter how inefficient, I am prepared to run a service for days, weeks, months, years, whatever it takes.

dave.brady AT uleth.ca, classic.grey AT gmail.com, ninjacommander AT hotmail.com. Take your pick. I will be eternally grateful for help.

theRPGFreak · « **Reply #1 on:** July 12, 2004, 06:44:37 PM »

Grey Ninja's back! Ill see if I can get you some help.

KDR_11k · « **Reply #2 on:** July 12, 2004, 10:08:36 PM »

Try a data recovery service to get the key, breaking a modern key-based encryption is impossible in a reasonable amount of time (as in "less than two millenia") unless you have a quantum computer.

rpglover · « **Reply #3 on:** July 13, 2004, 01:49:38 PM »

what's up grey- long time no see

this is the best i could do for you- http://www.password-crackers.com/service.html
the site guarantees the cracking of any encrypted file in a few days- read up about it- it does cost some money though

this site also- http://www.lostpassword.com/decryption-service.htm
the cost is high though- unfortunately i am not too good on cracking passwords and junk like that

i'll keep looking for you though

Gibdo Master · « **Reply #4 on:** July 13, 2004, 02:31:07 PM »

I bet the folder has porn in it.

Grey Ninja · « **Reply #5 on:** July 13, 2004, 04:55:56 PM »

Actually, due to a strange twist of fate, I remembered to decrypt the porn folder beforehand.

rpglover, thanks for the help, but I am dealing with plain text files that have been sealed by Windows' EFS (Encryption File System).

http://www.ntfs.com/internals-encrypted-files.htm

In a nutshell, it uses 120 bit RSA encryption (or something like that, I'm not a cryptography person), which I would need a lifetime to decrypt by brute force.

I have been digging through the remains of my reformatted and overwritten partition all of last night and tonight, and I have managed to recover my master key. However, my private key, which is used to actually unlock the file is gone for good. I have tried many different ways of getting at it, but I can't find squat.

New question for the day is... Does anyone know how to create an identical private key to one that was lost, providing I know the master key, and the username/password of the account in question? Password/username/key/sample file available if anyone thinks that they can do anything with it that I can't.

manunited4eva22 · « **Reply #6 on:** July 13, 2004, 05:57:15 PM »

Did you do an actual complete format, or did you just use windows format? If not, you might be able to use a ghosting program to see if it is still on there.

Grey Ninja · « **Reply #7 on:** July 13, 2004, 06:47:10 PM »

Actually, I used fdisk to delete the partition, then I did a complete reformat from the Windows XP Install CD. Then I installed Windows XP on top of that.

Nevertheless, I extracted a whole crapload of data from the freshly reformatted partition, the only thing of relevance being the master EFS encryption key. I am still missing my private key, but it's my HOPE that I can rebuild it somehow, since I still have my username and password. I am currently mucking with the security certificates and user accounts in the hopes of stumbling across the answer. I am seeing a whole lot more green in the Advanced EFS Recovery Tool than I was a few hours ago anyway.

Grey Ninja · « **Reply #8 on:** July 13, 2004, 08:20:00 PM »

I've seen nothing but EFS for the last day, and although I am still working on fixing this, I just want to say this right now.

DO NOT EVER USE EFS!!!!!!!!

EFS is just yet another means for Microsoft to piss off the consumer. It seems to serve absolutely no rational purpose, other than locking the user out of his/her own files. I used it under the assumption that the encryption was likely as easy to defeat as office documents, and I could probably break the encryption if really necessary. This was PARTIALLY true.

The truth of the matter is that user accounts and passwords and crap really don't matter to EFS. If you have both keys, you unlock the files. And these keys are files located on your hard drive. Nothing really magical or mysterious about them. Ordinary looking. (sort of). Any Administrators on your box can use those keys for whatever they desire, including unlocking files. If someone manages to get access to your hard drive, you've lost your keys.

The only thing that EFS seems exceptionally good at is locking your data for good once you've lost your keys. Because the encryption strength on the files is REALLY strong. But the locking mechanism seems like it was coded by that dude who works down at Radio Shack.

It still amazes me that Microsoft thought it would be a great idea to make an encryption system that doesn't unlock to your password or username... Boggles the mind.

enigma487 · « **Reply #9 on:** July 13, 2004, 10:01:42 PM »

the whole point of encryption is to protect your data. if you're saying it's so easy to crack with access to the hard drive, you've got the drive? wrong. the keys are still encrypted. Encryption that unlocks with just a username and password....great idea.... if you want no security. wow.

KDR_11k · « **Reply #10 on:** July 14, 2004, 02:28:28 AM »

I think you're supposed to keep the key separately from the data. Like on a USB stick or something. Encryption is the only thing that stops people from using Knoppix to get your files.

Grey Ninja · « **Reply #11 on:** July 14, 2004, 02:42:00 PM »

Perhaps I should rephrase that enigma... I just decrypted files that I encrypted as a test from a user account that was completely different than the one that encrypted the files. All I needed were the keys.

KDR_11k · « **Reply #12 on:** July 15, 2004, 05:34:00 AM »

I just saw a post on Slashdot that said the NTFS encryption is rather weak and his teacher demonstrated how to crack it in minutes. So there might be a way.

Grey Ninja · « **Reply #13 on:** July 15, 2004, 02:58:41 PM »

well, I hear a lot of that sort of thing on Slashdot. But I would be interested in learning more... you have a link to that post at all?

ThePerm · « **Reply #14 on:** July 15, 2004, 04:14:22 PM »

grey was any of this the porn i sent you?

mouse_clicker · « **Reply #15 on:** July 15, 2004, 06:15:37 PM »

If so I probably have copies of it all, in case he needs them.

Grey Ninja · « **Reply #16 on:** July 15, 2004, 07:26:56 PM »

Nah, the porn was unencrypted for easier access.

KDR_11k · « **Reply #17 on:** July 15, 2004, 10:10:55 PM »

Nope, he didn't have a link... He said something about testing against a few hashes, though.
The user key is generated from the master key, so maybe you can limit the number of keys to test that way.
Are you sure you wiped all accounts? The Admin gets a copy of the user key...

Could you try Ask Slashdot?

Grey Ninja · « **Reply #18 on:** July 16, 2004, 04:14:42 PM »

Actually, I thought it was the other way around... master key gets generated from the private key?

But I just might try ask slashdot later. If anyone knows how to actually do it, I'm sure it would be someone around there.

(Actually, I might even have two seperate master keys...)

Myxtika1 Azn · « **Reply #19 on:** July 27, 2004, 08:31:04 PM »

I'm not sure if you got what you needed, or if this is any help, but I found a site with a trial app that is said to decrypt files:

http://www.crackpassword.com/products/prs/otherms/efs/downloads.php

News:

Author Topic: Windows XP File Encryption (Read 3742 times)