Click here to Skip to main content
15,895,557 members
Home / Discussions / System Admin
   

System Admin

 
Generale-mail Pin
Omar _25-May-05 0:13
Omar _25-May-05 0:13 
GeneralRe: e-mail Pin
toxcct25-May-05 1:47
toxcct25-May-05 1:47 
GeneralRe: e-mail Pin
MoustafaS25-May-05 3:15
MoustafaS25-May-05 3:15 
GeneralRe: e-mail Pin
toxcct25-May-05 3:18
toxcct25-May-05 3:18 
GeneralRe: e-mail Pin
MoustafaS25-May-05 3:32
MoustafaS25-May-05 3:32 
GeneralRe: e-mail Pin
albCode6-Jun-05 2:51
albCode6-Jun-05 2:51 
GeneralRe: e-mail Pin
Vasudevan Deepak Kumar11-Jun-05 3:13
Vasudevan Deepak Kumar11-Jun-05 3:13 
GeneralRecovering deleted EFS-encrypted file Pin
Levente Farkas23-May-05 20:43
Levente Farkas23-May-05 20:43 
Hello,

I need to recover the content of a deleted encrypted file from a NTFS volume. I can read the file's content by directly accessing the volume (reading and decoding MFT, data runs and all that candy). I see that encrypted files have a named NTFS attribute of type LOGGED_UTILITY_STREAM (name is $EFS). I need to interpret the content of this, the goal being to obtain the (encrypted) FEK (file encryption key).

From the info I could gather so far, this data consists of:

struct EFS_INFO_HEADER
{
DWORD m_dwSize;
DWORD m_dwVersionMinor;
DWORD m_dwVersionMajor;
DWORD m_dwUnknown1;
BYTE m_Checksum[32];
BYTE m_Unknown2[36]; // this somewhere contains the count of following DDF
entries
// the DDF entries
// count of DRF entries
/// the DRF entries
};

struct EFS_ENTRY_HEADER
{
BYTE m_Unknown1[64];
};

struct EFS_DDF_ENTRY
{
EFS_ENTRY_HEADER m_Header;
// container name
// crypto provider name
// EFS certificate hash
// encrypted FEK
};

struct EFS_DRF_ENTRY
{
EFS_ENTRY_HEADER m_Header;

// container name
// crypto provider name
// EFS certificate hash
// encrypted FEK
};

Anyone knows more about these structures, where are they defined, where can I find more about them? Some of these structures seem to have members that are sometimes missing, and I cannot decide how to handle this. Any info, hint, pointer in the right direction would be welcome. Thanks a lot.

Regards,
Levente


------------------------------------------->>
Life is tough. Then die you do. [Yoda]
GeneralRe: Recovering deleted EFS-encrypted file Pin
Levente Farkas2-Jun-05 1:15
Levente Farkas2-Jun-05 1:15 
Generallimited Pin
Omar _23-May-05 7:20
Omar _23-May-05 7:20 
GeneralRe: limited Pin
toxcct23-May-05 21:31
toxcct23-May-05 21:31 
GeneralRe: limited Pin
ThatsAlok24-May-05 21:02
ThatsAlok24-May-05 21:02 
Generalexecutable files Pin
_tasleem22-May-05 20:27
_tasleem22-May-05 20:27 
GeneralRe: executable files Pin
Mekong River7-Jun-05 5:38
Mekong River7-Jun-05 5:38 
GeneralPostfix relaying mail question... Pin
Phil.Benson20-May-05 4:06
professionalPhil.Benson20-May-05 4:06 
QuestionHow to track the client..... Pin
Member 184298619-May-05 20:40
Member 184298619-May-05 20:40 
Generalsystem processes Pin
anuraga0218-May-05 18:08
anuraga0218-May-05 18:08 
GeneralRe: system processes Pin
Alexander German25-May-05 0:23
Alexander German25-May-05 0:23 
GeneralWildcard email addresses in exchange 2000 Pin
Malcolm Smart18-May-05 10:31
Malcolm Smart18-May-05 10:31 
GeneralRe: Wildcard email addresses in exchange 2000 Pin
Ryan McCauley21-May-05 13:08
Ryan McCauley21-May-05 13:08 
GeneralRe: Wildcard email addresses in exchange 2000 Pin
NeverHeardOfMe22-May-05 21:32
NeverHeardOfMe22-May-05 21:32 
GeneralRe: Wildcard email addresses in exchange 2000 Pin
Levente Farkas23-May-05 20:50
Levente Farkas23-May-05 20:50 
GeneralRe: Wildcard email addresses in exchange 2000 Pin
Malcolm Smart24-May-05 20:34
Malcolm Smart24-May-05 20:34 
GeneralDisable print screen feature Windows 2000 Pin
JON1088414-May-05 11:05
JON1088414-May-05 11:05 
GeneralRe: Disable print screen feature Windows 2000 Pin
Mekong River14-May-05 19:59
Mekong River14-May-05 19:59 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.