Collaborate Disseminate
I’m trying to copy EFS-encrypted files from an NTFS partition using:
ntfsdecrypt -k mycert.pfx /dev/sda2 -i 32768
and I get:
Key does not have an EFS purpose OID
Failed to extract the private RSA key.
More info:
The password is indeed c… Continue reading ntfsdecrypt – Key does not have an EFS purpose OID
I’m using a secondary drive to store encrypted files, in VeraCrypt file containers.
Unfortunately, even if the external drive is formatted as exFAT, Windows leaks information on files inside mounted VeraCrypt containers.
The highlighted f… Continue reading USN Journal leaks information on exFAT-hosted files (in VeraCrypt containers)
Is it possible to bypass NTFS encryption if the password used to encrypt the RSA key is a password to an AD account? So if an administrator can simply change your password, they would then be able to decrypt your files. My understanding of… Continue reading Bypass NTFS Encryption via Password Change (Encrypting File System)
I have some files on an NTFS USB drive.
The files were encrypted on a Windows 10 pc and copied to the USB.
I had to completely reinstall Windows on the PC. I do not have a backup of the USB files
I know the name of the PC, and the username… Continue reading Recovering NTFS encrypted files from a USB drive on a different machine
following problem:
A file is marked as being deleted without a tracked time-deletion date. However, timestamps such as File Accessed, Entry Modified etc. point e. g. to the 30.12.2019. Is it safe to assume that the deletion must have hap… Continue reading Identification of File Deletion Time
Can an NTFS volume be read by forensics without having to log into the windows user or provide any passwords? aka can data be read straight from the sectors in clear text?
Recently my semi-high-end Windows box as been acting up.
I get a big 5 seconds lag every minute or so.
I originally attributed the issue a GPU issue.
Popped open Task Manager to take a peek.
Inside Task Manager, I found t… Continue reading Explorer.exe – Power Usage Spikes w/~1m intervals
I’m learning digital forensics and have been given a Windows Vista image with a bunch of files encrypted using EFS. The image has been sufficiently mangled that it’ll never boot, but I have managed to mount the NTFS partition… Continue reading Decrypting EFS files
I am working on an Domain Controller / File Server on Windows Server 2012.
Lets say that I am from a school and that I have 3 OU’s (or security groups)
Students
Staff
IT
When I create a shared directory, where teachers c… Continue reading How do I need to secure my Windows Shares?
I have data saved on old NTFS-format hard disks which were encrypted on Windows machines, using EFS (the native file encryption system built into Windows). I encrypted selected files/folders, only, not the entire drive.
Is t… Continue reading Read NTFS / EFS encrypted files on iOS with saved certificate