Elcomsoft Improves Full Disk Encryption Workflow, Allows Faster Access to Encrypted Evidence

ElcomSoft Co. Ltd. releases a major update of Elcomsoft System Recovery, a bootable tool for unlocking Windows accounts and accessing encrypted volumes. Version 6.0 introduces a new workflow for full-disk encryption, allowing to quickly extract information required to launch password recovery attacks on volumes encrypted with BitLocker, PGP and TrueCrypt/VeraCrypt. In addition, the tool can extract the computer’s hibernation file to allow instant access to information stored in crypto containers.

Full Disk Encryption Workflow with Faster Access to Critical Evidence

Elcomsoft System Recovery 6.0 changes the way forensic experts access evidence stored on computers protected with full disk encryption, offering a simpler and faster approach for accessing evidence stored on encrypted computers. The traditional acquisition approach requires disassembling the computer, removing and imaging all of its storage devices. Elcomsoft System Recovery allows starting the investigation faster by booting the computer from a portable flash drive with read-only access to computer’s storage devices. The tool automatically detects full disk encryption on all built-in and removable drives, allowing experts to extract information required to brute-force the original password to encrypted disk volumes with Elcomsoft Distributed Password Recovery.

Full-disk encryption passwords can be difficult to break. A quicker alternative to brute-forcing the password might be available in a case the computer was hibernated while the encrypted partition was mounted. If this is the case, the decryption key could be stored in the system’s hibernation file. This decryption key can be quickly extracted and used to instantly mount or decrypt the encrypted volume with Elcomsoft Forensic Disk Decryptor without a lengthy attack.

Compatibility

Elcomsoft System Recovery offers unprecedented compatibility thanks to using genuine Windows PE environment. The tool creates a bootable Windows PE flash drive, allowing experts to load additional drivers if required. The tool is compatible with 32-bit and 64-bit BIOS and UEFI computers running all versions of Windows up to and including the last versions of Windows 10 and Windows Server 2019.

About Elcomsoft System Recovery

Elcomsoft System Recovery helps users and forensic expert recover or reset lost or forgotten passwords to Windows accounts. With instant access to locked and disabled accounts, Elcomsoft System Recovery can assign or revoke administrative privileges to user accounts, replace and recover account passwords. The ability to recover account passwords helps experts access EFS-encrypted files and folders, while the ability to extract hibernation files and password hashes from encrypted disk volumes offers faster access to protected evidence stored on encrypted partitions.

Elcomsoft System Recovery operates from the familiar Windows environment by booting into portable Windows PE from a USB flash drive. ElcomSoft makes it easy creating a flash drive with Windows bootable environment, delivering a complete bootable disc or image for both BIOS and UEFI computers.

About ElcomSoft Co. Ltd.

Founded in 1990, ElcomSoft Co.Ltd. is a global industry-acknowledged expert in computer and mobile forensics providing tools, training, and consulting services to law enforcement, forensics, financial and intelligence agencies. ElcomSoft pioneered and patented numerous cryptography techniques, setting and exceeding expectations by consistently breaking the industry’s performance records. ElcomSoft is Microsoft Certrified Partner (Gold competency), and Intel Software Premier Elite Partner.