|
Hello,
I need to recover the content of a deleted encrypted file from a NTFS volume. I can read the file's content by directly accessing the volume (reading and decoding MFT, data runs and all that candy). I see that encrypted files have a named NTFS attribute of type LOGGED_UTILITY_STREAM (name is $EFS). I need to interpret the content of this, the goal being to obtain the (encrypted) FEK (file encryption key).
From the info I could gather so far, this data consists of:
struct EFS_INFO_HEADER
{
DWORD m_dwSize;
DWORD m_dwVersionMinor;
DWORD m_dwVersionMajor;
DWORD m_dwUnknown1;
BYTE m_Checksum[32];
BYTE m_Unknown2[36]; // this somewhere contains the count of following DDF
entries
// the DDF entries
// count of DRF entries
/// the DRF entries
};
struct EFS_ENTRY_HEADER
{
BYTE m_Unknown1[64];
};
struct EFS_DDF_ENTRY
{
EFS_ENTRY_HEADER m_Header;
// container name
// crypto provider name
// EFS certificate hash
// encrypted FEK
};
struct EFS_DRF_ENTRY
{
EFS_ENTRY_HEADER m_Header;
// container name
// crypto provider name
// EFS certificate hash
// encrypted FEK
};
Anyone knows more about these structures, where are they defined, where can I find more about them? Some of these structures seem to have members that are sometimes missing, and I cannot decide how to handle this. Any info, hint, pointer in the right direction would be welcome. Thanks a lot.
Regards,
Levente
------------------------------------------->>
Life is tough. Then die you do. [Yoda]
|
|
|
|
|
While struggling to solve this problem I found another approach. This leaves me with two possible solutions, unfortunately both are crippled by the lack of information:
1. Either I read and parse the file's LOGGED_UTILITY_STREAM NTFS attribute (named $EFS), then I recover the encrtypted FEK from there (and then decrypt the FEK, etc.). The problem here is that even if in "Inside Windows 2000" the general structure of the $EFS attribute is described, I cannnot find precise documentation (a structure definition would be good!) for it (e.g. some fields may be missing and so on). After looking at hundreds of encrypted files, I still cannot empirically deduce this structure.
2. Either I use the WriteEncryptedFileRaw API and then I feed it with the necessary data in the callback function, essentially attempting a restore directly from the deleted file. Again, I see by attempting to use ReadEncryptedFileRaw that the data this API stuffs into my callback function on backup is some header, followed by the $EFS attribute (slightly modified!), then some addional data, probably another header, then the encryped content, interrupted every now and then by some unknown data. I have no documentation for any of these.
Anyone could give me a hand here, guys?
Levente
------------------------------------------->>
Life is tough. Then die you do. [Yoda]
|
|
|
|
|
hii guys :
i have an limited account on my computer and i want to change it into administrator ,please help me .
|
|
|
|
|
Omar _ wrote:
and i want to change it into administrator
programmatically ??
otherwise, you go to : "config panel" > "Admin tools" > "Cpu managment" > "users"
there choose your user and move it to the group you want. off course, to do this, you must be logged as an administrator, or at least whatever user that is allowed to change user rights...
TOXCCT >>> GEII power
[toxcct][VisualCalc]
|
|
|
|
|
Omar _ wrote:
i have an limited account on my computer and i want to change it into administrator ,please help me
Programmatically:-
http://www.codeproject.com/internet/caanetadminclass.asp[^]
"Opinions are neither right nor wrong. I cannot change your opinion. I can, however, change what influences your opinion." - David Crow
cheers,
Alok Gupta
|
|
|
|
|
hi
i want to know what is the name of exe file that executes the programs.sometimes programs himselft start running how it is possible.
ddd
|
|
|
|
|
If you have the shortcut of the an application that is running try to right click on that shortcut and go to property command and click on the shortcut tab. Than you will see the target file that is run the application.
For the an application that run automatically is base on the setting of the owner of the software. Some software, user start it via the task manager or draft a shortcut to the startup folder. Some application is designed as the windows services application which will run automattically when the windows start.
A thousand mile of journey, begin with the first step.
APO-CEDC
Save Children Norway-Cambodia Office
|
|
|
|
|
I was wondering, if it is possible, to create "rules", that if the recipient belongs to a specific domain, it could be routed to a specfic SMTP server. For example, my mail srever is mail.example.com, and the user are all, bill@example.com, mary@example.com etc. If bill where then to send a mail to bill@txt.example.com, I would like my mail server to relay this (and all other mails *@txt.example.com) to a specific IP address (SMTP server). I have no experence with this, but I need to set it up to do some testing. (I´ve already rtfm, and I´m no wiser  )
Thanks for any help or suggestions in advance
Phil
bum... and I thought I´d got rid of all the bugs
|
|
|
|
|
I have several clients which will connect to the communication server via DUN(dial up networking). The client make some request to the communication server after that the client gets disconnected.
Now after some time the communication server gets the information regarding the request and wants to deliver it to the client which has made the request. Now keep in mind that the ISP may differ. Now i want to deliver the message to specific ATM terminal....
So how can i know which client has made the requset? Any solution?
Thanks in advance.
Regards,
J Sachin
|
|
|
|
|
I want to know as to where can i find the log file for the currently running processes. i want to create a daemon that tells me how long a particular process has been active for, something like the system task manager. please help me out.
anurag
|
|
|
|
|
hi anuraga02, an this page: http://agerman77.blogspot.com you can find some example. It really shows how to list processes by a specific name, but it may give you an idea. The web site is in spanish. With the System.Diagnostics.Process class you can do all that you ask for.
Hope it helps.
Alexander German
|
|
|
|
|
I've trawled the net but can't work out how to configure exchange to accept [anything]@mydomain.com and put it in my me@mydomain.com mailbox. Email sent directly to me@mydomain.com is no problem, picked up from Outlook, but I need the wildcard as I give out different email addresses to different companies, depending on what product they're using. I've only just brought my email inhouse, my ISP used to have anything@mydomain forwarding for me.
Any help much appreciated.
Cheers
Angel.
*********************************************
The sooner you fall behind, the longer you have to catch up.
|
|
|
|
|
There actually isn't any native functionality in Exchange for this. You can add it with some slight modification using this set of scripts from Microsoft:
http://support.microsoft.com/default.aspx?scid=kb;en-us;324021
There's an application out there from a company called Turbogeeks that will do it too with a GUI - give that a search on Google, and I think it costs $100 or so.
|
|
|
|
|
I would hassle your ISP - they really ought to be able to sort this out for you - ie forward unknown aliases to any email address you want.
cheers
Phil
|
|
|
|
|
Of course, you can always add the e-mail addresses for each product to your user account, but I understand that this is not what you are looking for. However, it is the simplest and fastest way.
My two cents.
Levente
------------------------------------------->>
Life is tough. Then die you do. [Yoda]
|
|
|
|
|
Thanks all, but clearly I wasn't ready to take the step of hosting my own email server!!! It was up for 48 hours and spam took my server down - 350K+ messages all queued up for relay, and bang went the disk space.
Back to my ISP, tail firmly between my legs - If I had a tail.
Now...if somebody has wants a tutorial on 'How not to set up an exchange server', 'I'm your person'
Cheers
Angel.
*******************************************************
I bought a 'Teach Yourself To Read' book the other day.
|
|
|
|
|
Hi guys,
Just wondering if there's a way to disable the print screen feature on Windows 2000. I checked the active directory policies and I couldn't find it.
Thanks in advance.
|
|
|
|
|
Try to check the information from here[^] and let me know whether it is match what you need or not.
A thousand mile of journey, begin with the first step.
APO-CEDC
Save Children Norway-Cambodia Office
|
|
|
|
|
You can try out the following code in VB
Private Sub txtSearch_KeyDown(KeyCode As Integer, Shift As Integer)
If KeyCode = vbKeySnapshot or KeyCode = vbKeyPrint then
KeyCode = 0
End If
End Sub
You can put the code inside your application and can protect the same from PrintScreen event.
Kaushik Baruah,
Programmer Analyst in Cognizant Technology Solutions,Kolkata,India.
|
|
|
|
|
Thanks for the replies guys
Where exactly do I put in that code if I want it disabled for the entire OS? Also, is there a Java equivalent to this 'cuz the information I want to protect are actually inside a JTable in my Java program.
Thanks again!
|
|
|
|
|
Hello,
I have been trying to install the microsoft java vm on a windows 2000 machine. When i try to run the installation exe msjavax86.exe, it gives an error saying - it cannot update the virtual machine because it is a protected system component.
However, when i run jview from the command prompt it says 'unrecognized command name' which means there is no installed version of the virtual machine.
This is a windows 2000 sp4 machine with IE 6 sp 1.
Any help is appreciated!
Thanks
Sandhya
|
|
|
|
|
I think this article[^] might give you some answer.
A thousand mile of journey, begin with the first step.
APO-CEDC
Save Children Norway-Cambodia Office
|
|
|
|
|
Thanks for your reply..
I did go through that article.. It recommended installing an earlier version of the jvm. But i tried with 3805/3809/3810...
all gave the same error - The Microsoft virtual machine you are attempting to install is a protected system component and can only be updated with a later release of the operating system or service pack.
Any ideas???
Thanks again for ur help...
Sandhya
|
|
|
|
|
I want to set up two client PCs both having the basic Office software. Is there any benefit to having an additional machine as a server? Is there a cheaper option for buying Office for two clients?
Thanks for any help
|
|
|
|
|
You might want to consider a Microsoft Action Pack subscription - part of their Partner Program (go their website and type 'Action Pack' in their Search.) For about £180p/a you will get all the software you need to run a small business (Office Pro, SQLServer - in fact, all their Server s/w and OS's, and small-business orientated s/w, all kept up-to-date with new releases, for as long as you keep your subscription up.
cheers
Phil
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
