Accessing Windows encrypted files on another PC

Question

I am new to WIndows EFS and find it very useful except with a problem, can't access those files in another Windows PC. I find some tutorials on how to access them in other windows PCs(1, 2). After reading them, I have some questions:

• After importing the Encryption key to other pc to access the encrypted files in that PC, will the key be stored in that system forever?
• If the above is true, will they be able to access other encrypted files I give to them after that?

Answer 1

After importing the Encryption key to other pc to access the encrypted files in that PC, will the key be stored in that system forever?

Well, as long as their Windows account exists, and as long as they don't delete the key (e.g. via the Certificate Manager, certmgr.msc). Aside from that, it does not have any self-destruct date.

If the above is true, will they be able to access other encrypted files I give to them after that?

Yes. (So, in general, it is fairly stupid to give someone else your own EFS key.)

Instead, remember that these keys are like SSL certificates, with a public half & a private half. Under Properties → Advanced there is a list of all users who should have access. So you could import someone else's public key (the certificate), and add it to the list for your files.

Answer 2

EFS is designed to protect files against access in scenarios where an unauthorised user can read the hard disk, for example:

• a member of the Administrators group who can change ACL permissions, or
• a person with physical access to the computer removing the disk and installing it into another computer over which they have full control

In stand-alone installations, Windows automatically generates a self-signed EFS certificate when a user encrypts their first file. By default, this is the only private key that can decrypt files. Users who rely on EFS should always:

• export their EFS certificate (including the private key) and store it in a secure location, or
• backup their files to a destination that is not encrypted using the same EFS key (eg to a flash drive that is not encrypted)

The original question already references guides for exporting and importing a user's EFS certificate. In this answer, we'll just re-iterate that EFS encrypts files with a certificate that is stored in the user's Personal certificate store:

Note: In enterprise environments, it is common to specify a 'Data Recovery Agent' (DRA) certificate using a Group Policy Object setting. When a DRA certificate is specified, it is added files that are encrypted. This allows files to be decrypted using either the original EFS certificate private key or the DRA private key. In stand-alone environments, this is also possible, but not common.

The Windows operating system stores a user's EFS certificate, in protected form, in that user's Profile directory. It is relatively easy to recover this key using some specialised tools, if:

• the user's Profile directory can be accessed (usually, C:\Users\<Username>)
• the user's logon password is known

The tools you will need are:

• mimikatz command-line utility to extract keys (download the latest version from the releases page)
• OpenSSL command-line utility to build the EFS certificate (download the latest Windows binary from slproweb.com)

In the following steps, we assume that the profile directory of the user who encrypted the files is at D:\Backup\Users\John Citizen.

Step 1: Find out which certificate was used to encrypt the file

We will open command prompt and use the Windows built-in 'cipher' utility.

(Note: the first line is the command that must be executed; the following lines show output from the command.)

cipher /c my_encrypted_file.docx

...
  Users who can decrypt:
    John Citizen [xxxxxx]
    Certificate thumbprint: 9556 EAC7 EEE6 46DF 9453 63A7 F90B 3E3C F69E D981
...

Step 2: Export public key and identify location of the private key

We will use the thumbprint from the previous to export the public key and locate the private key. In a command prompt window, start mimikatz and follow these steps.

mimikatz # crypto::system /file:"D:\Backup\Users\John Citizen\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\9556EAC7EEE646DF945363A7F90B3E3CF69ED981" /export

...
[0002/1] KEY_PROV_INFO_PROP_ID
  Provider info:
        Key Container  : 63d5bb1c-3461-4af2-982e-7034ef01479a
        Provider       : Microsoft Enhanced Cryptographic Provider v1.0
        Provider type  : RSA_FULL (1)
        Type           : AT_KEYEXCHANGE (0x00000001)
        Flags          : 00000000
        Param (todo)   : 00000000 / 00000000
...

This saves the public key to 9556EAC7EEE646DF945363A7F90B3E3CF69ED981.der. The output also tells us that the private key is stored in the Microsoft Enhanced Cryptographic Provider v1.0 container 63d5bb1c-3461-4af2-982e-7034ef01479a.

Step 3: Find the private key container

mimikatz # dpapi::capi /in:"D:\Backup\Users\John Citizen\AppData\Roaming\Microsoft\Crypto\RSA\<__USER_SID__>\<YYYY>"
...
**KEY (capi)**
  dwVersion          : 00000002 - 2
  dwUniqueNameLen    : 00000025 - 37
  dwSiPublicKeyLen   : 00000000 - 0
  dwSiPrivateKeyLen  : 00000000 - 0
  dwExPublicKeyLen   : 0000011c - 284
  dwExPrivateKeyLen  : 0000064e - 1614
  dwHashLen          : 00000014 - 20
  dwSiExportFlagLen  : 00000000 - 0
  dwExExportFlagLen  : 000000fc - 252
  pUniqueName        : 63d5bb1c-3461-4af2-982e-7034ef01479a   <<< MATCHES VALUE FROM STEP 1
...
  **BLOB**
    dwVersion          : 00000001 - 1
    guidProvider       : {df9d8cd0-1501-11d1-8c7a-00c04fc297eb}
    dwMasterKeyVersion : 00000001 - 1
    guidMasterKey      : {e5cfe43c-d545-44c3-9bd7-da3ffc2013a0}   <<< ID OF THE MASTERKEY

You may have to try several folders/files inside the Crypto\RSA folder, until you find the private key that has a pUniqueName equal to the Key Container value from Step 1. The line starting with guidMasterKey tells us the Id of the master-key used to encrypt the private key (in this case, it's e5cfe43c-d545-44c3-9bd7-da3ffc2013a0).

Step 4: Obtain the master key

In this step, we will need the user's logon password.

(If we don't have it, then there are still options, but they're out of scope for this answer.)

dpapi::masterkey /in:"D:\Backup\Users\John Citizen\AppData\Roaming\Microsoft\Protect\<__USER_SID__>\e5cfe43c-d545-44c3-9bd7-da3ffc2013a0" /password:<__USERLOGONPASSWORD__>

...
[masterkey] with password: <__USERLOGONPASSWORD__> (normal user)
  key : <__MASTERKEY__>
  sha1: 1b9f5ce5543a42b9933f26bbb7b7dd83d7929ee1   <<< HASH OF THE MASTERKEY
...

Step 5: Decrypt the private key

mimikatz # dpapi::capi /in:"D:\Backup\Users\John Citizen\AppData\Roaming\Microsoft\Crypto\RSA\__USER_SID__\<YYYY>" /masterkey:1b9f5ce5543a42b9933f26bbb7b7dd83d7929ee1

...
        Key size       : 2048
        Private export : OK - 'raw_exchange_capi_0_63d5bb1c-3461-4af2-982e-7034ef01479a.pvk'
...

Step 6: Create a certificate file

In this step, we will create a PFX certificate file from the public key file we obtained in Step 1 and the private key file we obtained in Step 4.

openssl x509 -inform DER -outform PEM -in 9556EAC7EEE646DF945363A7F90B3E3CF69ED981.der -out public.pem
openssl rsa -inform PVK -outform PEM -in raw_exchange_capi_0_63d5bb1c-3461-4af2-982e-7034ef01479a.pvk -out private.pem
openssl pkcs12 -in public.pem -inkey private.pem -password pass:<__NEW_PASSWORD_TO_PROTECT_THIS_PFX_FILE__> -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out my_efs_certificate.pfx

This will generate a PFX certificate file named my_efs_certificate.pfx.

Step 7: Import the PFX certificate

Import the PFX certificate using any of the following methods:

1. Open the Certificate Management snap-in (certmgr.mmc; see screenshot at the top of this answer). Right-click the Personal\Certificates folder and select Import.

2. Double-click on the PFX file.

3. Use the Windows built-in certutil command-line utility:

certutil -user -p mimikatz -importpfx my_efs_certificate.pfx NoChain,NoRoot

Voila! You should now be able to access files encrypted with this user's EFS certificate.