After creating a case, the Encrypted Files container lists EFS files. However, no decrypted sub- items are present. All other necessary components for EFS decryption are present in the case. Which…

Question

Options

• ASAM
• Bsystem
• CSECURITY
• DMaster Key
• EFEK Certificate

• A
  75% (18)
• C
  4% (1)
• D
  8% (2)
• E
  13% (3)

Explanation

SAM and SYSTEM are required together because FTK recovers the EFS password by cracking the Windows user account credentials. The SAM (Security Account Manager) file stores the local user password hashes, but it cannot be read in isolation - the SYSTEM hive contains the SYSKEY (boot key) that encrypts the SAM database. FTK needs both files together to extract and crack the password hash, which then unlocks the user's private key and ultimately decrypts the EFS files.

Why the distractors are wrong:

• C (SECURITY): Holds LSA secrets and security policy data but is not required for EFS password recovery in FTK.
• D (Master Key): The DPAPI Master Key is a product of the user's password - it's derived from it, not a source for recovering it. It's already present and accounted for in "all other necessary components."
• E (FEK Certificate): The File Encryption Key certificate encrypts the FEK for a user, but it doesn't help recover the password needed to access the private key.

Memory tip: Think "SAM can't stand alone" - SAM holds the hash, but SYSTEM holds the lock that protects it. You always need both, like a key (SYSTEM) and a door (SAM). No SYSTEM = can't read SAM = can't recover the password.

No community discussion yet for this question.