Pros & Cons
-
- Recovers Windows-encrypted files.
- Free trial shows exactly what it can recover.
-
- You must have the password for the locked-out account.
ElcomSoft Advanced Encrypting File System Data recovery Specs
| OS Compatibility: | Windows Vista |
| OS Compatibility: | Windows XP |
| Type: | Personal |
Locking your car to keep the street punks from stealing it is smart. But when you lock the keys inside it, that's a whole different security problem. In the same way, Windows handily encrypts private files, but many common events can leave you locked out as well. If you've just plain forgotten the password, you're screwed. Had you previously backed up your encryption credentials, you could regain access to your files, but few users have the foresight and technical skill to do this. Don't worry: ElcomSoft's Advanced Encrypting File System Data Recovery (AEFSDR) can get you out of this jam.
The Problem
Windows NT4, 2000, XP, and Vista, as well as Windows Server 2003 and 2008, support the Encrypting File System for any disks formatted as NTFS (the default). To encrypt a file or folder you right-click on it, choose Properties, and click the Advanced button in the Attributes area. Then check the box "Encrypt contents to secure data" and click OK, twice. If it's a folder, specify whether you also want to encrypt its contents and subfolders. Easy! When you're logged in, you won't notice any difference, except that Windows Explorer displays the filenames in green text. But any other user who tries to open one of those files will get "Access denied."
The problem is that it's just too easy to lose access to these files. If you delete an account and then remember that you left some files encrypted, you're out of luck. Re-creating the account with the same username and password won't bring back the same account, so the files stay encrypted. If you completely reinstall Windows to solve some drastic problem, you'll lose access to encrypted files (though a repair-reinstall that retains existing user accounts should be okay). If your computer dies and you put the drive into another machine to recover what data you can, oops—those encrypted files won't yield their secrets. And, according to ElcomSoft's Vladimir Katalov, even if none of these bad things happen, just one damaged Registry entry could corrupt Windows certificate storage and block your access to encrypted files.
Windows Vista at least recognizes the possible danger. The first time you use file encryption, it offers to back up your encryption credentials and even walks you through the process. XP doesn't offer a similar warning, but if you change the password for an account other than the active one, it warns that this account will lose access to EFS-encrypted files. Alas, many users breeze past these warnings.—
The Solution
For each account that uses encryption, Windows creates a key file on disk, and each encrypted file links to the key file of the user account that enabled encryption. AEFSDR scans the system's drives to make a list of these key files. It also scans for encrypted files and internally matches the encrypted files with the key files it found.
Matching up the files isn't enough. AEFSDR also needs the appropriate password to decrypt the files. The password itself isn't stored in the key, but a "hash" function can identify whether a given password is the correct one for a key. If you're not sure which password was used or if files were encrypted by multiple accounts, just enter all of the passwords that might be correct and AEFDSR will try them all. If none of them work, you're out of luck. AEFDSR won't crack them for you.
On the plus side, a malefactor who steals your computer can't use it to break your encryption. Unless, that is, you left your password on a sticky note or used a dreadfully weak password like "password." AEFDSR does include a last-ditch option to check the found keys against a list of some hundred-odd common passwords. If you've totally lost your password you can give this a try. According to the help system, this can significantly slow the process of decrypting the keys in Vista and Windows Server 2008, but hey—if it works, you're saved.—
Testing File Recovery with AEFSDR
I encrypted some files using a secondary user account, then logged back into my main account and deleted the secondary account. As expected, I couldn't access the encrypted files. When I launched the trial version of AEFSDR, it started off with a wizard that automatically scanned the system for keys, scanned for encrypted files, and prompted me to enter any relevant usernames and passwords. I made sure to enter the correct password. The last screen of the wizard correctly listed the files I had encrypted and identified them all as available for decryption.
When I tried to continue and decrypt the files, the program asked for some cold cash. Until you purchase and register it, AEFDSR will decrypt only the first 512 bytes of each file. Just to see what would happen, I saved the partially decrypted files and checked them out using a byte-level editor. Yes indeed, the first 512 bytes of one file visibly represented a JPG file header, but all subsequent bytes were replaced by zeroes. This is quite impressive, even so. Without spending a penny I identified the files that could be recovered and even partially recovered them. If there's nothing the app can help you with, you don't have to pay. I like that. I registered the product and repeated the whole process, ending with successful recovery of all the encrypted files.
Next I mounted a virtual drive belonging to a different virtual machine in my test system, simulating what happens when you have to mount the hard drive from a broken computer. Here again the program worked smoothly. It identified the encrypted files and, once I supplied a password, decrypted them.
AEFSDR can't solve every file encryption problem. If an employee gets hit on the head with a flowerpot and forgets all his passwords, there's nothing the program can do. If a disgruntled employee deliberately locks up important files before quitting, ouch! But if one of the common events mentioned earlier locks you out of your encrypted files, AEFSDR can jimmy the lock. Best of all you, can see exactly what it will do before deciding whether to pay for it.
More Security Software Reviews:
Final Thoughts
ElcomSoft Advanced Encrypting File System Data recovery
It's way too easy to lose access to Windows-encrypted files. As long as you can remember a password for the account that did the encrypting, this product will recover those lost files, and its free trial shows exactly what it will do before you pay.