Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am looking into using EFS (Encrypting File System) at file/folder level on Windows 7.

I read Wikipedia article on EFS and it does mention several vulnerabilities related to Windows 2000 and XP. Apparently they have been fixed in later OS versions.

Then I found this tool (Advanced EFS Data Recovery, AEFSDR): http://www.elcomsoft.com/aefsdr.html that allows to decrypt EFS encrypted files in some cases. I am now trying to understand just how vulnerable EFS is on Windows 7 is when this tool is used.

AEFSDR product page mentions Windows 2000 vulnerability that can be ignored. Other than that it doesn't have a lot of details.

More information is offered here: http://www.elcomsoft.com/cases/tips_on_recovering_EFS-encrypted_data_when_it_gets_lost.pdf . In paragraph called "Solution" it says:

Advanced EFS Data Recovery allows one to decrypt files even if the user database is protected with SYSKEY. First, AEFSDR searches for all EFS keys, scanning the hard drive sector by sector. After the user has entered the user password into the program, the software decrypts the keys, or at least one key, needed for decryption of user’s encrypted data. On the second stage AEFSDR looks for EFS-encrypted files in the file system and attempts to recover them. The recovery rate is usually very high, 99% or more.

So user password had to be entered. I assume that was a password for Windows User account.

My question is this: consider the laptop with EFS encrypted files/folder was stolen and it was shut down at the time (completely off, not in sleep/hibernate mode). No user passwords are available for intruder but the hard drive can obviously be removed and accessed by another computer. Will it be possible to decrypt any of the files?

share|improve this question
2  
Yep... nobody ever thought EFS was particularly secure, but they persisted. If you really need disk encryption, take the control out of Microsoft's hands and install TrueCrypt. –  digitxp Aug 30 '11 at 19:19
1  
+1 for TrueCrupt. I use it on my laptop, which quite solidly secures it whether it's completely shut down or just hibernating. And if you're set to require a password to resume from sleep, the typical approach to bypassing that is to shut down the computer, and either boot from a CD or yank the hard drive and attach it to another computer to access it -- which is rendered all but impossible by TrueCrypt, making even sleep mode pretty effective against attack! (That said, shut down or hibernate is still safer by far.) –  Kromey Aug 30 '11 at 19:30
add comment

2 Answers

TrueCrypt should give you better security than EFS, and it also offers the same functionality as BitLocker (full disk encryption).

The only downside to TrueCrypt (compared to EFS) is that it does not allow you to encrypt individual files and folders on your hard drive; instead, you create an encrypted volume, either on a disk or within a file on your drive, which you then mount as a separate encrypted volume.

Unfortunately, this is not a Vault-style solution, which means that (just like EFS) once you're logged in, your files are unsecure. TrueCrypt, EFS, and BitLocker do not offer Vault-style security.

share|improve this answer
add comment

EFS is designed to protect your files based on your password. Therefore if your password is long and complex enough and of course it is only used for login it should be safe.

But usually Windows user passwords are much too short. Unfortunately Windows 7 stores them in special hashed way (NTLMv2) - older versions even in the more unsecure NTLM version. Using current graphic cards as code cracker even NTLMv2 password can broken:

Cracking NTLMv2 Authentication (from 2002) The interesting part is the second last slide even if it only considers old CPUs for breaking the password.

AFAIK only a complex password with 12 or more characters can be considered secure at the moment.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.