EFS is designed to protect files against access in scenarios where an unauthorised user can read the hard disk, for example:
- a member of the Administrators group who can change ACL permissions, or
- a person with physical access to the computer removing the disk and installing it into another computer over which they have full control
In stand-alone installations, Windows automatically generates a self-signed EFS certificate when a user encrypts their first file. By default, this is the only private key that can decrypt files. Users who rely on EFS should always:
- export their EFS certificate (including the private key) and store it in a secure location, or
- backup their files to a destination that is not encrypted using the same EFS key (eg to a flash drive that is not encrypted)
The original question already references guides for exporting and importing a user's EFS certificate. In this answer, we'll just re-iterate that EFS encrypts files with a certificate that is stored in the user's Personal certificate store:
Note: In enterprise environments, it is common to specify a 'Data Recovery Agent' (DRA) certificate using a Group Policy Object setting. When a DRA certificate is specified, it is added files that are encrypted. This allows files to be decrypted using either the original EFS certificate private key or the DRA private key. In stand-alone environments, this is also possible, but not common.
The Windows operating system stores a user's EFS certificate, in protected form, in that user's Profile directory. It is relatively easy to recover this key using some specialised tools, if:
- the user's Profile directory can be accessed (usually,
C:\Users\<Username>
)
- the user's logon password is known
The tools you will need are:
mimikatz
command-line utility to extract keys (download the latest version from the releases page)
OpenSSL
command-line utility to build the EFS certificate (download the latest Windows binary from slproweb.com)
In the following steps, we assume that the profile directory of the user who encrypted the files is at D:\Backup\Users\John Citizen
.
Step 1: Find out which certificate was used to encrypt the file
We will open command prompt and use the Windows built-in 'cipher' utility.
(Note: the first line is the command that must be executed; the following lines show output from the command.)
cipher /c my_encrypted_file.docx
...
Users who can decrypt:
John Citizen [xxxxxx]
Certificate thumbprint: 9556 EAC7 EEE6 46DF 9453 63A7 F90B 3E3C F69E D981
...
Step 2: Export public key and identify location of the private key
We will use the thumbprint from the previous to export the public key and locate the private key. In a command prompt window, start mimikatz
and follow these steps.
mimikatz # crypto::system /file:"D:\Backup\Users\John Citizen\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\9556EAC7EEE646DF945363A7F90B3E3CF69ED981" /export
...
[0002/1] KEY_PROV_INFO_PROP_ID
Provider info:
Key Container : 63d5bb1c-3461-4af2-982e-7034ef01479a
Provider : Microsoft Enhanced Cryptographic Provider v1.0
Provider type : RSA_FULL (1)
Type : AT_KEYEXCHANGE (0x00000001)
Flags : 00000000
Param (todo) : 00000000 / 00000000
...
This saves the public key to 9556EAC7EEE646DF945363A7F90B3E3CF69ED981.der
.
The output also tells us that the private key is stored in the Microsoft Enhanced Cryptographic Provider v1.0 container 63d5bb1c-3461-4af2-982e-7034ef01479a
.
Step 3: Find the private key container
mimikatz # dpapi::capi /in:"D:\Backup\Users\John Citizen\AppData\Roaming\Microsoft\Crypto\RSA\<__USER_SID__>\<YYYY>"
...
**KEY (capi)**
dwVersion : 00000002 - 2
dwUniqueNameLen : 00000025 - 37
dwSiPublicKeyLen : 00000000 - 0
dwSiPrivateKeyLen : 00000000 - 0
dwExPublicKeyLen : 0000011c - 284
dwExPrivateKeyLen : 0000064e - 1614
dwHashLen : 00000014 - 20
dwSiExportFlagLen : 00000000 - 0
dwExExportFlagLen : 000000fc - 252
pUniqueName : 63d5bb1c-3461-4af2-982e-7034ef01479a <<< MATCHES VALUE FROM STEP 1
...
**BLOB**
dwVersion : 00000001 - 1
guidProvider : {df9d8cd0-1501-11d1-8c7a-00c04fc297eb}
dwMasterKeyVersion : 00000001 - 1
guidMasterKey : {e5cfe43c-d545-44c3-9bd7-da3ffc2013a0} <<< ID OF THE MASTERKEY
You may have to try several folders/files inside the Crypto\RSA
folder, until you find the private key that has a pUniqueName
equal to the Key Container value from Step 1.
The line starting with guidMasterKey
tells us the Id of the master-key used to encrypt the private key (in this case, it's e5cfe43c-d545-44c3-9bd7-da3ffc2013a0
).
Step 4: Obtain the master key
In this step, we will need the user's logon password.
(If we don't have it, then there are still options, but they're out of scope for this answer.)
dpapi::masterkey /in:"D:\Backup\Users\John Citizen\AppData\Roaming\Microsoft\Protect\<__USER_SID__>\e5cfe43c-d545-44c3-9bd7-da3ffc2013a0" /password:<__USERLOGONPASSWORD__>
...
[masterkey] with password: <__USERLOGONPASSWORD__> (normal user)
key : <__MASTERKEY__>
sha1: 1b9f5ce5543a42b9933f26bbb7b7dd83d7929ee1 <<< HASH OF THE MASTERKEY
...
Step 5: Decrypt the private key
mimikatz # dpapi::capi /in:"D:\Backup\Users\John Citizen\AppData\Roaming\Microsoft\Crypto\RSA\__USER_SID__\<YYYY>" /masterkey:1b9f5ce5543a42b9933f26bbb7b7dd83d7929ee1
...
Key size : 2048
Private export : OK - 'raw_exchange_capi_0_63d5bb1c-3461-4af2-982e-7034ef01479a.pvk'
...
Step 6: Create a certificate file
In this step, we will create a PFX certificate file from the public key file we obtained in Step 1 and the private key file we obtained in Step 4.
openssl x509 -inform DER -outform PEM -in 9556EAC7EEE646DF945363A7F90B3E3CF69ED981.der -out public.pem
openssl rsa -inform PVK -outform PEM -in raw_exchange_capi_0_63d5bb1c-3461-4af2-982e-7034ef01479a.pvk -out private.pem
openssl pkcs12 -in public.pem -inkey private.pem -password pass:<__NEW_PASSWORD_TO_PROTECT_THIS_PFX_FILE__> -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out my_efs_certificate.pfx
This will generate a PFX certificate file named my_efs_certificate.pfx
.
Step 7: Import the PFX certificate
Import the PFX certificate using any of the following methods:
Open the Certificate Management snap-in (certmgr.mmc
; see screenshot at the top of this answer). Right-click the Personal\Certificates
folder and select Import.
Double-click on the PFX file.
Use the Windows built-in certutil
command-line utility:
certutil -user -p mimikatz -importpfx my_efs_certificate.pfx NoChain,NoRoot
Voila! You should now be able to access files encrypted with this user's EFS certificate.