Elcomsoft Advanced EFS Data Recovery

Question

The Elcomsoft "Advanced EFS Data Recovery" whitepaper says

First the program tries to do this automatically, for example trying to extract the password from cache or system files, checking simple combinations (such as password=username) and then conducts an attack using a medium-sized built-in dictionary.

What's the probability that Elcomsoft can find a cached password on Windows 7?

Answer 1

I don't think you're going to come up with a numeric probability value, here. But there are in fact several places where passwords get cached temporarily when they're used. The chances are higher if you use the same password in multiple places, and many tools for this purpose also scan the drive for anywhere you might have a copy fo the password stored somewhere -- such as saved credentials, Word documents, email conversations, etc. All of this automated, of course. If you have the person's computer in your posession, your chances of retrieving their password is significantly higher than if you don't.

Answer 2

There are several possibilities to extract passwords from a computer. I do not know specifically about Elcomsoft's product, however the probability for any software to find passwords on Windows 7 is probably big.

I've written a blog post about this before which can be found here: http://www.securesolutions.no/ways-to-retrieve-a-missing-persons-account-passwords/. An excerpt of the post can be found below.

The full blog post contains how to possibly retrieve account information from other places as well, such as in temporary internet files or recover deleted files.

The SAM file

As I’ve written about before, the SAM file contains account information on Windows OS. This file can trivially be dumped when physical access to the machine is in hand. The hashes, in some cases weak LANMAN, can then be proceeded to be attacked in order to reveal the clear-text password.

Cain & Able also have the possibility to dump passwords from machines local system account, often called LSA secrets.

Discover stored passwords in browser or other applications

Very many applications provide some sort of “remember password” logic to provide easier access to resources that is password protected. Most people will recognize this function in our browsers. They provide an option to store the users password in a database and automatically fill inn these when the user navigates to a login form the browser remember. There is also other applications than just browsers that offer to store passwords for the user. For example many popular games are known to store the users password, or other software like Filezilla has been known to do the same.

SecurityXploded.com has a list over currently 47 applications and where they store their passwords. To mention a few:

• Skype
• MSN Messenger
• Windows Live Messenger
• Microsoft Outlook
• Heroes of Newerth