Safeboot 4.2 plugin for bartPE External links Options

[b01100110]

I need to find a Safeboot v4.2 plugin for BartPE so i can get so i can get to the data I do have the id and password
however the domain was removed and replaced by a work group no i can no longer access the computer I donot know the local login information. this is for a customer of and it is time critical I would appreciate an help thank you

[was_jaclaz]

I need to find a Safeboot v4.2 plugin for BartPE so i can get so i can get to the data I do have the id and password
however the domain was removed and replaced by a work group no i can no longer access the computer I donot know the local login information. this is for a customer of and it is time critical I would appreciate an help thank you

A safeboot 4.2 BartPE plugin should have been included in the 4.2 release (CD):
http://forums.mcafeehelp.com/showthread.php?t=229119

A plugin was posted for UBCD4WIN:
http://www.forensicfocus.com/index.php?nam...opic&t=3812
http://ubcd4win.com/forum/index.php?showtopic=11191

You may want to try contacting Kevin Bentley at http://www.dedicatedrecovery.com/

jaclaz

[maanu]

if all you need /want is to login to a password protected account , you can use kon-boot if you just want to bypass it or NT offline password and registry editor .

edit :

oops sorry i misunderstood it . may be booting from the pe will get you to the data ?

[was_jaclaz]

if all you need /want is to login to a password protected account , you can use kon-boot if you just want to bypass it or NT offline password and registry editor .

edit :

oops sorry i misunderstood it . may be booting from the pe will get you to the data ?

maanu
safeboot is a Commercial protection/encryption system, nothing "standard".

JFYI:
http://www.mcafee.com/us/about/corporate/m...r_safeboot.html

I would hope you cannot access data protected with such an expensive tool easily.

jaclaz

[maanu]

hmm interesting .

actually my knowledge about encryption is next to none . but it might be useful for me just to know how to bypass it .

is every encryption utility has its own mechanism of bypassing it with a password or something?

i ll try to google it that how to bypass this safeboot thing .

[was_jaclaz]

hmm interesting .

actually my knowledge about encryption is next to none .

Yes, I can see that.

but it might be useful for me just to know how to bypass it .

is every encryption utility has its own mechanism of bypassing it with a password or something?

You DO NOT "by-pass" encryption, you unencrypt data.

Unless the encryption algorithm is flawed, just as an example some older Winzip .zip files and multiple files in archive, there is NO way to "bypass" it, you need to find the appropriate password (or key-file) to perform the unencryption.
And this won't normally work "easily" as you may think.

Of course passwords like "mypass" and "password" are pretty easy to find with brute-force, but as soon as you go to, say, 12 alphanumeric characters+punctuation, on normal, fast, dedicated PC's (and with a really fast algorithm) it will take anything from a few weeks to several months to brute-force (possibly years).

In the case at hand, safeboot normally needs it's own program to unencrypt data, even if you know password and id, and it is not easy to make it work, as it uses a server daily issued authentication and whatnot.

jaclaz

[maanu]

last night when i started googling , i saw a post where a user said that he reverse engineered safe boot's encryption somehow ( i believe he meant de-crypt as you'r saying ) . but he did not share how .

then it linked me to password protected hdd's . oh man . it took me about 2 hours before pain started in my eyes .i was thanking God that i have not recieved anything like that i mean a hdd with stuff like above to salvage data from . otherwise i 'd have to tell that guy to excuse me .

but anyhow i could not find a solution to password protected hdd's yet but still im searching for it . i saw a commercial solution though .

and as far as encryption is concerned ,it seems it is dangerous when it comes to safe boot . i have seen posts where the users were asking help because they could not access there hdd's when windows got corrupt and they still had the safeboot login details .
thats why a plug in would be needed ?

why we dont have a script for it YET ?

by the way i was thinking that how CIA OR FBI are doing this stuff ? i mean decrypting or breaking the password protected hdd for forensic purposes ??

[was_jaclaz]

last night when i started googling , i saw a post where a user said that he reverse engineered safe boot's encryption somehow ( i believe he meant de-crypt as you'r saying ) . but he did not share how .

I would rephrase that to:

last night when i checked the first link jaclaz gave on the thread, this one:
http://www.forensicfocus.com/index.php?nam...opic&t=3812
i saw a post where a user said that he reverse engineered safe boot's encryption somehow ( i believe he meant de-crypt as you'r saying ) . but he did not share how .

And actually you are wrong.

What user Edge reported was:

• that there was a small flaw in the safeboot version 4.2 that compromised the encryption scheme
• that there may be ways on v5 too

A little bit of reverse engineering on v5 can go a long way and on v4 a small flaw in SafeBoot logic can mitigate their entire security. I am not going to discuss on the forum how to reverse engineer or bypass their logic as I have no idea what legal ramifications would exits if I did.

i.e. that he supposedly has an actual way to bypass the encryption and/or to validate non-right credentials to unencrypt.

but anyhow i could not find a solution to password protected hdd's yet but still im searching for it . i saw a commercial solution though .

Rest assured, there are NONE (if we speak "generically" about "password protected HD's".
There may be some specific ones for a given specific encryption scheme or for a specific program, leveraging on a flaw on the encryption algorhitm or on a security hole in the program.

and as far as encryption is concerned ,it seems it is dangerous when it comes to safe boot . i have seen posts where the users were asking help because they could not access there hdd's when windows got corrupt and they still had the safeboot login details .
thats why a plug in would be needed ?

Yes.
But the whole point is that lots of morons inexperienced people encrypt their data for no real reason, have not a sound recovery plan, do not test accurately the features of the encryption programs they chose, they don't simulate a data failure (and recovery), they don't make "safe" copies of the data, thoughtlessly remove authentication servers/criteria/etc. and then go around crying that they cannot get their data back.

why we dont have a script for it YET ?

I cannot say the reason, but you have to consider the following "tree of decisions":
Are you a criminal or however involved in illegal activities?

• if yes, you may want to encrypt all your data, but you won't go around crying you lost it
• if no, you DON'T need to encrypt your data

Are you a politically involved person and you live in a country where you may be persecuted for your ideas?

• if yes, you may want to encrypt all your data, but you won't go around crying you lost it
• if no, you DON'T need to encrypt your data

Are you working for any country secret service or counterspy organization?

• if yes, you may want to encrypt all your data, but you won't go around crying you lost it
• if no, you DON'T need to encrypt your data

Are you working for a leading edge, technological or military involved industry where the theft of data might be a great problem?

• if yes, you may want to encrypt all your data, but you won't go around crying you lost it
• if no, you DON'T need to encrypt your data

Are you a lawyer or member of a law firm or bank/financial institution where theprivacy of your customers and their data is a priority ?

• if yes, you may want to encrypt all your data, but you won't go around crying you lost it
• if no, you DON'T need to encrypt your data

Are you in any way needing to protect actually confidential data and your customers trust you will never disclose such info?

• if yes, you may want to encrypt all your data, but you won't go around crying you lost it
• if no, you DON'T need to encrypt your data

Are you 15 and you have a nosy little sister/brother?

• if yes, you may want to encrypt all your data, AND you will go all around the internet crying you lost it
• if no, you DON'T need to encrypt your data

Alternate answer:

• if yes, and you are young but not stoopid, you may want to encrypt all your data, AND either use a "good-enough" encryption algorithm (enough to prevent access to a 10 years lad) OR plan properly everything AND have prepared an emergency plan.

by the way i was thinking that how CIA OR FBI are doing this stuff ? i mean decrypting or breaking the password protected hdd for forensic purposes ??

They could tell you, but they would also have to kill you afterwards...

More seriously, NO encryption scheme is "safe" in an absolute sense, it is only a problem on how many resources you can use on it and the amount of time you have at your disposal.

Governments have, besides technical means, legal ones (example):
http://www.out-law.com/page-8515

JFYI, a few "historical" links to interesting things you might not be aware of:
http://www.sigpc.net/v1/n22.htm
http://www.distributed.net/rc5/
http://www.cdt.org/crypto/risks98/
http://www.garykessler.net/library/crypto.html


And some undesirable effects of encryption:
http://www.viruslist.com/en/weblog?weblogid=208187524

Moral:
If you want to really keep data secret, DO NOT write it ANYWHERE.

The only safe is to store info in your head (provided you are not forgetful) and keep your big mouth shut.

An alternative, actually in practice much safer than plain cryptography is steganography:
http://en.wikipedia.org/wiki/Steganography
(for limited amounts of data, of course)



jaclaz

[b01100110]

your decision tree is interesting however there is another one.
an executive of a large corporation is given a laptop by her company (it has safeboot on it) she retires and begins working as a consultant for that same company. she then tries to setup her home office as a small network at which point she can no longer logon to the domain and she does not know the local passwords for the computer.

we can get by the safeboot login, bu cannot login to windows because of the domain error.

Thank you for your help, If i get an answer I will share with you. duane

[maanu]

you could use kon boot first to bypass the password ,

http://www.piotrbania.com/all/kon-boot/

since you already have the safe boot login .

@ Sir Jaclaz

it is looooong reply but interesting one i ll have to go one by one . but no i wont use encryption in near future unless i fulfill the criteria you given above .