The Professional version 4.0 of Advanced EFS Data Recovery (AEFSDR Pro) for Windows, a powerful data recovery application that makes it easy to recover (decrypt) files encrypted on NTFS (EFS) partitions created in Windows 2003, XP, 2000, Vista and 2008, was released by ElcomSoft Co.Ltd. AEFSDR Pro can perform low-level disk scanning at the sector level, enabling data recovery and forensics specialists to find encryption keys that have been deleted, even on drives that have been reformatted, in addition to all of the capabilities of the Standard version.

    Microsoft EFS allows users to store confidential information on a computer when people who have physical access to a computer could otherwise compromise that information, intentionally or unintentionally. EFS is especially useful for securing sensitive data on portable computers or on computers shared by several users. Another layer of security is added by encrypting sensitive files by means of EFS.

    The popularity of EFS encryption has made it critical for forensics experts and anti-terrorism operatives to have tools like AEFSDR that can give them access to data files. More and more people are using EFS encryption to protect their files, because the standard Windows logon password can be circumvented using widely-available software (such as Elcomsoft System Recovery). AEFSDR Pro is a must-have application for law enforcement officials, security specialists and military intelligence officers.

    The Professional version of AEFSDR lets data experts recover files where users have set up multiple logical disks, for example. a 'C' Drive that contains Windows plus a 'D' Drive that holds data. When the system has serious problems, users will often reformat the 'C' Drive, and reinstall Windows, knowing that their data is safe on the 'D' partition. However, EFS encryption stores its encryption keys in certificates that are located on the system drive. After reinstalling Windows, encrypted data files on the D Drive are no longer accessible.

    Even if the drive has been reformatted, AEFSDR Pro can search all of the sectors on the 'C' Drive, one-by-one, and find the deleted certificates.

    With both the Standard and Professional versions of AEFSDR, protected files can be decrypted, even when the system is not bootable so users cannot log on, or when some encryption keys (private or master) have been tampered with. In addition, decryption is possible even when Windows is protected using SYSKEY. AEFSDR effectively (and instantly) decrypts the files protected under all versions of Windows 2000, Windows XP (including Service Pack 2), Windows 2003 and Windows Vista.

    In addition to enhancing EFS security protection in Vista, Microsoft has added a new Vista facility called BitLocker. BitLocker, however, will be used to protect only a small portion of Vista users' data. BitLocker works only on the Ultimate Version of Vista. It requires special hardware in the form of a TPM chip on the motherboard. Also, BitLocker protects only the system drive, but none of the data drives. AEFSDR will continue to work effectively with the non-BitLocker portion of data stored on Vista machines.

    AEFSDR makes it easier for business managers to deal with lost and destroyed encryption keys, as well as with employees who, intentionally or unintentionally, are unable to access critical files that have been encrypted. While some situations make it impossible to recover encryption keys, if the keys are somewhere on the system, and not totally corrupted, AEFSDR can usually find and restore the critical information that will make the system accessible again.

    AEFSDR is also a state-of-the-art computer forensics tool that is used extensively by law enforcement, military and intelligence agencies to open secured files.

    The program includes faster decryption speeds under all versions of Windows, as easy-to use Wizard that lets computer novices and experts quickly identify and decrypt files, and improved support for non-US versions of Windows including Japanese, Chinese and other versions that use UNICODE.