Is EFS/BitLocker secure?
Results 1 to 9 of 9

Thread: Is EFS/BitLocker secure?

  1. #1
    Senior Member nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,190

    Is EFS/BitLocker secure?

    Well, we had that report about the possibility of recovering the password from the RAM of a machine that had recently shut down or was in standby, by cooling the strips with a can of compressed air.

    OK, M$ said that it was a highly improbable scenario, and I am inclined to agree with that.

    Then I read that:
    ElcomSoft has released the Professional version 4.0 of Advanced EFS Data Recovery
    http://www.snpx.com/cgi-bin/news55.c...09967it?-18610

    So what is the real story?

  2. #2
    Junior Member
    Join Date
    Jun 2006
    Posts
    8
    As demonstrated by the team that used liquid nitrogen to freeze the ram and than scan and recover the encryption keys it is possible.

  3. #3
    Right turn Clyde Nokia's Avatar
    Join Date
    Aug 2003
    Location
    Button Moon
    Posts
    1,696
    Anything has ot be better than the pre-vista Windows EFS.
    Drugs have taught an entire generation of kids the metric system.

    http://tazforum.**********.com/

  4. #4
    Senior Member nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,190
    If this works:

    http://www.elcomsoft.com/aefsdr.html

    It wouldn't make a blind bit of difference.

  5. #5
    @ΜĮЙǐЅŦГǻţΩЯ D0pp139an93r's Avatar
    Join Date
    May 2003
    Location
    St. Petersburg, FL
    Posts
    1,696
    One thing I did not see mentioned was whether it can recover when the entire drive is EFS...

    Recovering specific files wouldn't be a problem, given that keys can be retrieved without too much difficulty by anybody who knows what to look for, given that they have direct access to the hard drive. Would the key recovery still be possible under full drive encryption... thereby encrypting the pagefile and other key retrieval locations as well, IIRC?
    Real security doesn't come with an installer.

  6. #6
    Senior Member nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,190
    One thing I did not see mentioned was whether it can recover when the entire drive is EFS...
    I think that it would (at least the expensive one )

    Advanced EFS Data Recovery decrypts files protected with EFS quickly and efficiently. Scanning the hard disk directly sector by sector
    That sounds as if it works like roadkil's "Unstoppable Copier" which will read all the drive and copy everything:

    http://www.roadkil.net/unstopcp.html

    The claim that it will work with "damaged disks" also suggests that it would handle an entire EFS drive.

    Anyway, you could always copy the entire drive to a partition on a bigger drive and run it against that?

  7. #7
    @ΜĮЙǐЅŦГǻţΩЯ D0pp139an93r's Avatar
    Join Date
    May 2003
    Location
    St. Petersburg, FL
    Posts
    1,696
    Quote Originally Posted by nihil
    I think that it would (at least the expensive one )



    That sounds as if it works like roadkil's "Unstoppable Copier" which will read all the drive and copy everything:

    http://www.roadkil.net/unstopcp.html

    The claim that it will work with "damaged disks" also suggests that it would handle an entire EFS drive.

    Anyway, you could always copy the entire drive to a partition on a bigger drive and run it against that?
    Except that if the entire drive is encrypted, wouldn't the keys that needed to be retireved also be encrypted themselves? Unless of course it's some sort of MBR resident key?
    Real security doesn't come with an installer.

  8. #8
    Senior Member nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,190
    Hi Doppy,

    Except that if the entire drive is encrypted, wouldn't the keys that needed to be retireved also be encrypted themselves? Unless of course it's some sort of MBR resident key?
    I have no idea, but the software claims to work with EFS. It might well be my imagination, but the description on their website gave the impression that it knew how to decrypt the keys "on the fly" as in cracking, rather than finding something unencrypted somewhere and using that as a point of entry.

    On a very simplistic level, when you attempt to access an encrypted drive, it asks you for credentials which it must authenticate against something, somewhere, somehow. So you can get in (or it would be useless )

    Obviously, these guys don't say how their software works.................

    The reason I raised the whole issue is that I know people who think that EFS protects them big time..............errrr.................... not if I can go on the internet and for a few hundred dollars buy a tool that will open it up like a can of Coke ???????????

  9. #9
    Right turn Clyde Nokia's Avatar
    Join Date
    Aug 2003
    Location
    Button Moon
    Posts
    1,696
    Don't need fancy software to defeat EFS...just need the local admin password by default....or domain admin if on a domain.

    Who ever wrote the orignal article is either misleading folks to make the sodtware sound better, or does not understand EFS totally.
    Last edited by Nokia; March 7th, 2008 at 01:07 PM.
    Drugs have taught an entire generation of kids the metric system.

    http://tazforum.**********.com/

Similar Threads

  1. Port List
    By ThePreacher in forum Miscellaneous Security Discussions
    Replies: 17
    Last Post: December 14th, 2006, 09:37 PM
  2. Tips
    By XTC46 in forum Site Feedback/Questions/Suggestions
    Replies: 15
    Last Post: August 24th, 2005, 08:52 PM
  3. Apache, PHP, MySQL with basic security settings.
    By nightcat in forum The Security Tutorials Forum
    Replies: 9
    Last Post: May 28th, 2005, 03:47 AM
  4. Using IPSec to Secure Computers and Network Traffic.
    By Tiger Shark in forum The Security Tutorials Forum
    Replies: 0
    Last Post: October 7th, 2004, 08:18 PM
  5. ports
    By hatebreed2000 in forum AntiOnline's General Chit Chat
    Replies: 1
    Last Post: March 14th, 2003, 06:36 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •