ElcomSoft Advanced EFS Data Recovery

ElcomSoft Advanced EFS Data Recovery

Restore Access to EFS-Encrypted Files

Microsoft Encrypting File System (EFS) is an integral part of Microsoft Windows operating systems that enables users to protect their files against unauthorized access even from those who gain physical access to the hard disk or the computer that contains the encrypted files.

Advanced EFS Data Recovery decrypts the protected files, and works in all versions of Windows 2000, XP, 2003, Vista, Windows 7, Windows 8, Windows 8.1, Windows Server 2008, Windows Server 2012. The recovery is still possible even when the system damaged, is not bootable, or when some encryption keys have been tampered with.

Advanced EFS Data Recovery recovers EFS-encrypted data that becomes inaccessible because of system administration errors such as removing users and user profiles, misconfiguring data recovery authorities, transferring users between domains, or moving hard disks to a different PC.

Case Studies

Advanced EFS Data Recovery is a powerful data recovery tool that helps recovering the encrypted files under various circumstances.

EFS-protected disk inserted into a different PC

Deleted users or user profiles

User transferred into a different domain without EFS consideration

Account password reset performed by system administrator without EFS consideration

Damaged disk, corrupted file system, unbootable operating system

Reinstalled Windows or computer upgrades

Formatted system partitions with encrypted files left on another disk

Why Encrypted Files Become Inaccessible

The EFS appears completely transparent to the user, providing on-the-fly encryption and decryption of data with strong cryptographic algorithms. The ease of use and complete transparency to the end user creates false impression of impeccability of the Encrypting File System in the eyes of the user, who often forget about the encrypted files when they re-install Windows or transfer a disk into a new, upgraded computer.

Recovering Encrypted Files

Advanced EFS Data Recovery decrypts files protected with EFS quickly and efficiently. Scanning the hard disk directly sector by sector, Advanced EFS Data Recovery locates the encrypted files as well as the available encryption keys, and decrypts the protected files. The direct access to the file system allows Advanced EFS Data Recovery to recover encrypted files in the most difficult cases even if the disk with data is only available without a valid user account to login into system, or when some encryption keys have been tampered with.

Instant Access

With Advanced EFS Data Recovery, instant access to EFS-protected files is often possible. The product is well aware of the EFS encryption weakness present in Windows 2000, allowing quickest recovery of the encrypted files. Supplying a valid password to the user account (or a previously used password if the password has been reset by a system administrator, causing EFS-protected files to become inaccessible) or an account that serves as a data recovery agent (Administrator account by default) can often provide on-the-fly decryption of the protected files.

The Professional edition locates master and private keys in the deleted files as well, scanning the disk sector by sector and using patterns to locate the keys, allowing the recovery of re-formatted disks and overwritten Windows installations.