[SOLVED] ASK:Find list of file in windows harddisk which have EFS encryption

b-RAM · 06-03-2013, 08:21 AM

Hi all, sorry, i need some advise, is there any way to find out
list of file in Windows Server 2008 R2 harddisk which have EFS encryption.

I'm using some CD knoppix/Damn Small Linux USB to do that.

I need know how to do that because in fact i cannot access the Server 2008 R2 cause the old IT change the password and lack documentation about this.

Thank's a lot

schneidz · 06-03-2013, 08:58 AM

what does the file command print out for one of those files.

else maybe you can use od to print the first few bytes and see if there is any pattern ?

b-RAM · 06-03-2013, 10:00 PM

Thank's a lot for your reply schneidz, AFAIK the file pattern in windows explorer can be set the attribute in folder edit/option panel view, that's why I never find out / face this situation using USB boot system linux and list the file.

If I try to reset the password what afraid me the most are maybe exist some file with encryption EFS, if that happen it will be make the files become unreadable (cmiiw).

Thank's and pardon me about this

schneidz · 06-04-2013, 07:09 AM

please show the output of this command

Code:

file /path/to/some/encrypted/file

jefro · 06-04-2013, 04:28 PM

My bet is you would not be able to use linux to try to recover an EFS secured file or directory. The windows server certification and web pages like technet and microsoft web pages tell you how to recover windows file when using EFS.

The way the EFS works makes it very difficult to hack into them. You could use brute force but that may take a few hundred years.