Dear Richard,
You could try EFS key from Passware but to retrieve the files, the
encryption password must be known or SAM database must be present.
There is also Advanced EFS Data Recovery from Elcomsoft available at
http://www.elcomsoft.com/aefsdr.html
But again it requires the EFS key to be present or the user password and
syskey to be known to the user.
HTH
Chetan Gupta
--
Chetan Gupta GCFA, CEH, CCNA, CIW Sec. Analyst
Head, Forensic Services
NII Consulting Pvt. Ltd.
Email: [EMAIL PROTECTED]
Mobile: +91 9867780965
Web: www.niiconsulting.com
------------------------------------------------------
Online Computer Forensics Magazine
http://www.niiconsulting.com/checkmate
Comprehensive Incident Response and Forensics Services
http://www.niiconsulting.com/services/liveresponse.html
------------------------------------------------------
Rikard Johnels wrote:
I have a drive where i need to investigate one encrypted folder full of
equally encrypted files. (XP default type encryption of files/folders)
The original system disk is unavailable due to a wipe, so the key is lost.
Is there any way to rebuild the files to make an investigation possible?
