[VulnDiscuss] EFS vs. Elcomsoft

So I think it's interesting that no one has made special note that
Elcomsoft totally smashed through Microsoft's encrypted file system, and
now sells an application that allows people to easily unencrypt files from
disk images. I know a lot of CxO's that think encrypting their company's
documents with EFS is making them more secure, but it turns out apparantly
the key is stored in the registry. Elcomsoft did a talk on it for BlackHat
Europe, but nothing has been posted to anywhere that stressed that for 99
bucks, every CxO's documents  on a imaged disk are all cleartext.

Dave Aitel
Immunity, Inc.