Rikard,
Was the disk/encryption authenticated at a server, i.e. was the key
locally authenticated of was it done on a central server which was a
part of the domain?
Bhushan Shah, CCE
International Society of Forensic Computer Examiners
Forensic Analyst
NII Consulting Pvt. Ltd.
Email: [EMAIL PROTECTED]
Mobile: +91 9322390797
Web: www.niiconsulting.com
------------------------------------------------------
Online Computer Forensics Magazine
http://www.niiconsulting.com/checkmate
Comprehensive Incident Response and Forensics Services
http://www.niiconsulting.com/services/liveresponse.html
------------------------------------------------------
Rikard Johnels wrote:
I have a drive where i need to investigate one encrypted folder full of
equally encrypted files. (XP default type encryption of files/folders)
The original system disk is unavailable due to a wipe, so the key is lost.
Is there any way to rebuild the files to make an investigation possible?
