Comments on Computer Forensics, Malware Analysis & Digital Investigations: Bypassing a Windows login password in order to boo...

Thanks you very much for this useful information....

2009-07-23T23:52:43.590-07:00

Thanks you very much for this useful information.
Please keep on blogging.
I am looking forward to read your next great article.SEO

This was a pleasure to read. Thank You!

2009-06-10T18:34:10.944-07:00

This was a pleasure to read. Thank You!

http://www.youtube.com/v/CmA2oily65A

2008-05-06T09:55:13.518-07:00

http://www.youtube.com/v/CmA2oily65A

Frizzi,That is a very strong statement, and not ...

2008-05-06T08:29:26.271-07:00

Frizzi,

That is a very *strong* statement, and not entirely true. I have tested this and there are a couple of conditions that exist that allow you to access the EFS data using the techniques I described, and then ther are some conditions in which you can't.

I had not yet updated the blog to include them since I discovered them after my intial comment about being able to access EFS data.

You are correct that if a user has a password set and then encrypts some data using EFS then using the above technique does not give you access to the EFS data.

You are incorrect that if a user does not initialy have a password set then encrypts some data, then sets a password, the above technique will work.

Thanks for your comments

you CANNOT access EFS encrypted files on XP and Vi...

2008-05-06T03:21:20.329-07:00

you CANNOT access EFS encrypted files on XP and Vista if you hex edit the SAM and do the 0x14 to 0x04 SAM conversion trick.

I did some followup testing on this and found that...

2008-04-15T02:06:22.414-07:00

I did some followup testing on this and found that when there are encrypted files using the EFS feature, and a password is set on the user account, you can use the technique I described to bypass the password and you can STILL GET ACCESS to the encrypted files!

Another (simple) way to get around user authentica...

2008-03-28T06:14:11.692-07:00

Another (simple) way to get around user authentication is to use Dreampack : http://www.d--b.webpark.pl/dreampackpl_en.htm

To make it even more convenient there's a plugin to use it with BartPE.

Works flawless with XP, haven't tried it with VISTA yet...

Jeff,I knew I felt a presence in the darkness ;)Th...

2008-03-16T08:51:28.206-07:00

Jeff,

I knew I felt a presence in the darkness ;)

That's a good question. I have never had the need to get access to protected storage this way so I have not tested it, but it would be a simple thing to test. As soon as I get a little time to test, I will post the results.

Long time e-stalker, first-time poster...Utilizing...

2008-03-15T10:11:39.919-07:00

Long time e-stalker, first-time poster...

Utilizing the second method you described - telling Windows that no password is set for a given account - will this method disallow you from accessing the protected storage when doing a live boot? I know that blanking the password value would have this effect, but I'm curious what would happen if the password hash remains and you use a utility to dump the protected storage.

Thanks! And great blog, BTW.

Jeff

Awesome stuff as usual. Thanks for the link to 'be...

2008-02-22T21:39:50.732-08:00

Awesome stuff as usual. Thanks for the link to 'beginningtoseethelight', I have never seen this before.

Cheers.

Comments on Computer Forensics, Malware Analysis & Digital Investigations: Bypassing a Windows login password in order to boo...

Thanks you very much for this useful information....

This was a pleasure to read. Thank You!

http://www.youtube.com/v/CmA2oily65A

Frizzi,That is a very *strong* statement, and not ...

you CANNOT access EFS encrypted files on XP and Vi...

I did some followup testing on this and found that...

Another (simple) way to get around user authentica...

Jeff,I knew I felt a presence in the darkness ;)Th...

Long time e-stalker, first-time poster...Utilizing...

Awesome stuff as usual. Thanks for the link to 'be...

Frizzi,That is a very strong statement, and not ...