EFS Encryption with OSForensics V8 (Part 1)

Within OSForensics, the Certificate Manager module allows the user to install a PFX backup or recovery certificate that is associated with Windows EFS encrypted files from a disk image or another system.

In Part 1 of this demonstration, we see how simple locate and extract EFS encrypted files and PFX certificates from live systems using OSForensics V8.

In Part 2, we will cover installing the PFX certificate and unlocking and viewing the encrypted files. You can view Part 2 here: https://youtu.be/bn2jFJ8dr98

For more information on OSForensics, or to Download a Free 30 Day Trial visit https://www.osforensics.com/