>Michael Burnette wrote: >This method no longer works on the XP implementation of EFS, right? In order for an original account or recovery agent to retain the ability to decrypt >previously encrypted files, the password change must be made from within the host OS. Someone correct me if I'm wrong. Michael is correct about the password change in XP but rather the password changing must be made from the same user profile that is logged on in XP. Example, If I log onto XP as 'Administrator1' and change 'Administrator2's' local password, you will get a warning that says something like "This user's profile may become inaccessible after this password change. Are you sure you want to do this?" This is Microsoft's little EFS disclaimer that really does not explain what will happen but I have found out by trial and error. If you do change another user's password in XP and they are using EFS for some files, then you had better have the EFS recovery key (backup EFS Administrator key) or the files are in never-never land. Kevin Shannon, Sr. Network Administrator-US DOT/FAA/AVN/ avn.faa.gov Sr. ADP Specialist-Lockheed Martin InformationTechnology www.it.lockheedmartin.com Office - 405.954.7134 Email - Kevin.M-CTR.Shannonat_private "Opportunity is missed by most people because it is dressed in overalls and looks like work." - Thomas A. Edison Notice-The comments in this email reflect the views of it's author and are neither the views of the FAA nor that of Lockheed Martin. |---------+----------------------------> | | "Burnette, | | | Michael" | | | <MWB@rh-law.com> | | | | | | 01/30/2003 08:44 | | | AM | | | | |---------+----------------------------> >---------------------------------------------------------------------------------------------------------------------------------------------| | | | To: <forensicsat_private> | | cc: | | Subject: RE: Identifying Win2K/XP Encrypted Files | >---------------------------------------------------------------------------------------------------------------------------------------------| This method no longer works on the XP implementation of EFS, right? In order for an original account or recovery agent to retain the ability to decrypt previously encrypted files, the password change must be made from within the host OS. Someone correct me if I'm wrong. Michael Burnette Rogers & Hardin LLP Atlanta, GA -----Original Message----- From: Craig Earnshaw [mailto:Craig.Earnshawat_private] Sent: Thursday, January 30, 2003 8:13 AM To: Christopher Howell Cc: forensicsat_private Subject: Re: Identifying Win2K/XP Encrypted Files I would actually suggest a different method. If you are tasked to seize a machine you should do ABSOLUTELY NOTHING with it, apart from pulling the plug out of the wall if it's up and running. Any actions that you perform on the machine could potentially destroy evidence and subsequently be used to suggest that you have tampered with the evidence. The best scenario for dealing with the Windows 2000 encrypted file system (EFS) is to seize the machine, image it with you imaging tool of choice (Safeback, EnCase, dd etc etc) and then restore the image onto a blank drive, replace the drive in the original machine with you new copy of the drive, and then boot using a Linux boot disk developed by Peter Nordahl (I think his name is) available from http://home.eunet.no/~pnordahl/ntpasswd/. This can be used to change the logon passwords for the users of the machine, and let you log into their accounts (there are some caveats to this, but they're set out on the site so I'm not going to duplicate them here). Once you're logged into the accounts you are able to access all files stored within an EFS. Just my 2c - hope that it helps. Regards Craig G Earnshaw Head of Forensic Computing Services Lee & Allen Consulting Ltd London - New York - Hong Kong Christopher Howell wrote: >Does anyone know a slick way to find encrypted files on a running Win2K/XP machine? If I am tasked with seizing one, and find it on and logged in, it would be nice to be able to identify files encrypted with Windows before I pull the plug. It seems to me the only way to do it is to view the attributes in Windows Explorer - but short of clicking down through the whole tree, I don't see how to find encrypted files that are in non-encrypted folders or a level or two down... > >Anyone with ideas on this? > > ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com This message and any attachments are intended for the use of the addressee(s) only and may be confidential and covered by the attorney/client and other privileges. If the reader is not the intended recipient, DO NOT READ, notify sender and delete this message. In addition, be aware that any disclosure, copying, distribution or use of the contents of this message is strictly prohibited. ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Thu Jan 30 2003 - 10:04:05 PST