IT Forensics – Windows

Forensic Analysis of Windows EFS – Examining Encrypted Files and Certificates

Das Encrypting File System (EFS) ermöglicht die dateibasierte Verschlüsselung einzelner Dateien und Ordner unter Windows. Im Rahmen einer IT-forensischen Untersuchung können EFS-Artefakte Hinweise auf verschlüsselte Daten, Zertifikate, Benutzerzuordnungen und die eingesetzten Schutzmechanismen liefern.

Enquire without obligation

Eine professionelle Analyse erfolgt niemals isoliert. Erst die Korrelation mit Benutzerprofilen, Zertifikatsspeichern, DPAPI-Artefakten, Registry-Einträgen und weiteren Windows-Artefakten ermöglicht eine belastbare technische Bewertung.

Why LanCologne?

Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and assist companies, solicitors, private individuals and, on a regular basis, the courts in the technical investigation of complex digital matters.

The examination is carried out exclusively on a forensic copy or a forensic image. The original evidence remains unchanged and is stored in a manner that preserves its evidential integrity.

Our services

We analyse EFS-related artefacts, evaluate encryption information and correlate all findings with other Windows artefacts. All stages of the investigation are documented in a transparent manner.

Typical areas of application

•Examination of encrypted files
•Incident Response
•Analysis of compromised user accounts
•Reconstruction of system configurations
•Employment law proceedings
•Expert reports for the courts

This is how the analysis works

Once a forensic image has been created, all relevant EFS artefacts are analysed and technically assessed alongside other digital evidence.

Warum sind EFS-Artefakte wichtig?

EFS artefacts provide evidence of the use of file encryption and its configuration. However, their significance can only be determined through a comprehensive analysis of all relevant digital traces.

Frequently Asked Questions

Was ist Windows EFS?+
EFS ist die integrierte dateibasierte Verschlüsselungsfunktion von Windows.
Kann jede verschlüsselte Datei entschlüsselt werden?+
Nein. Dies hängt unter anderem von den vorhandenen Schlüsseln, Zertifikaten und dem Untersuchungsauftrag ab.
Is the original system being examined?+
No. Only a forensic copy or forensic image is analysed.
Reichen EFS-Artefakte allein für ein Gutachten aus?+
No. They are always analysed alongside other Windows artefacts.

LanCologne – Windows Forensics in Cologne

Do you require a professional analysis of Windows EFS artefacts or other Windows components? LanCologne can assist you with the forensically sound preservation of digital evidence and the objective analysis of complex Windows systems.

Get in touch now