RE: Windows private folder option decryption

["dave kleiman" <dave () isecureu com>]

Here are some helpful links:

http://www.beginningtoseethelight.org/efsrecovery/

http://www.elcomsoft.com/aefsdr.html

http://www.jsiinc.com/subi/tip4400/rh4475.htm

http://www.jsiinc.com/subh/tip3500/rh3595.htm

http://www.crackpassword.com/products/prs/otherms/efs/

http://support.microsoft.com/default.aspx?scid=kb;en-us;259732&sd=tech

http://www.lostpassword.com/efs.htm


______________________________________
Dave Kleiman, CISSP, CISM, CIFI, MCSE
www.SecurityBreachResponse.com
 

-----Original Message-----
From: Jon Lawhead [mailto:samurai () berkeley edu] 
Sent: Tuesday, December 07, 2004 15:01
To: security-basics () securityfocus com
Subject: Windows private folder option decryption

Hey all,

I work as a tech, and I have a problem that I haven't encountered before,
and am looking for ideas.  I have a client who attempted to upgrade the
drivers for his graphics card, but somehow botched it and now his computer
won't boot into windows.  I would generally fix the problem by booting into
Knoppix, but he's encrypted all his files using the Windows private folder
option in XP, so that doesn't work.  Does anyone know of any tools and/or
procedures that I could use to get around this, either by decrypting the
files via knoppix or by any other means.  If I can't find anything, I'm
going to be forced to tell him to just reformat, which I don't want to do.
Thanks for your help!


Jon Lawhead
UC Berkeley SINE/ResComp