Abstract:

Objective In the process of electronic data forensics, data encryption and decryption is often the focus of forensics personnel. DPAPI is widely used as a data protection interface provided by the Windows system, and is currently mainly used to protect encrypted data. Its characteristics are mainly manifested in that encryption and decryption must be operated on the same computer. The generation, use and management of the key are completed by the Windows system. If the computer is replaced, the DPAPI encrypted data cannot be unlocked. This article analyzes the DPAPI encryption mechanism in depth to achieve the purpose of offline decryption of the DPAPI encrypted data in the Windows system storage area. Methods Through in-depth research and analysis of the DPAPI encryption process and decryption process of multiple operating systems such as Windows XP, Windows 7, and Windows 10, it is determined that offline decryption of data in the system storage area mainly depends on the system registry file and master key file. Results Using the restored decryption process and algorithm, as well as the system's registry file and master key file, the DPAPI encrypted data can be unlocked normally. Conclusion This method can achieve the purpose of offline decryption of DPAPI encrypted data in Windows system storage area.

Key words:

data protection interface, system storage area, master key, decryption, forensics

摘要：

 目的 在电子数据取证过程中，数据的加解密经常是取证人员关注的重点。数据保护接口（DPAPI）作为Windows系统提供的数据保护接口被广泛使用，目前主要用于保护加密的数据。其特性主要表现在加密和解密必须在同一台计算机上操作，密钥的生成、使用和管理由Windows系统内部完成，如果更换计算机则无法解开DPAPI加密数据。通过对DPAPI加密机制的分析，以达到对Windows系统存储区的DPAPI加密数据进行离线解密的目的。方法 通过深入研究分析Windows XP、Windows 7、Windows 10等多款操作系统的DPAPI加密流程和解密流程，确定系统存储区数据离线解密主要依赖于系统的注册表文件和主密钥文件。结果 利用还原后的解密流程和算法，以及系统的注册表文件和主密钥文件，可以正常解开DPAPI加密数据。结论 该方法可达到对Windows系统存储区的DPAPI加密数据进行离线解密的目的。

关键词:

数据保护接口, 系统存储区, 主密钥, 解密, 取证