1

I have data saved on old NTFS-format hard disks which were encrypted on Windows machines, using EFS (the native file encryption system built into Windows). I encrypted selected files/folders, only, not the entire drive.

Is there any possibility to read/decrypt these EFS-encrypted files/folders, on iOS? I know iOS can read (but not write) to NTFS drives, but I didn’t know if the read capability also includes access to encrypted files, which is part of NTFS standard. I do not have a Mac, so cannot test this personally.

I have the original EFS encryption certificates saved separately from the encrypted drives and know the password.

Michael
  • 11
  • 1

1 Answers1

1

EFS uses Alternative Data Streams (ADS), an NTFS feature that some third-party file system drivers have little-if-any support for. Even if the driver supports ADS, no guarantee that it also supports EFS, especially as that would require having somewhere to input the user's key. Each EFS file is encrypted with a unique key, and that key is itself encrypted ("wrapped") with the user keys of every user that has access to the file, and those wrapped keys are stored in ADS of the file; the EFS certs you backed up contain the user key needed to unwrap the file keys.

In theory, there's no reason that you couldn't use an iOS app to decrypt EFS files. First, The app would need to be able to access the hard disk in question (which is not a storage medium that iOS devices usually connect to). Then it would need to know how to access the ADS, how to read the EFS metadata, and how to import the user key (plus you'd need to supply the key and its password). From there, though, EFS uses a well-known (and somewhat outdated by this point) cryptographic cipher suite; an iOS app would have no problems handling it.

I don't know if an app with these capabilities has ever been written. It seems unlikely; iOS is very much not an OS built for this kind of work. Is there some reason you can't just use a Windows (or, next-best, Linux) machine to decrypt the files? On Windows it would be easy (just re-import the cert and user key), and on Linux I'm sure you could find a utility to handle EFS files.

CBHacking
  • 40,303
  • 3
  • 74
  • 98