Elcomsoft Improves Full Disk Encryption Workflow, Allows Faster Access to Encrypted Evidence

News provided by

Apr 25, 2019, 07:13 ET

MOSCOW, April 25, 2019 /PRNewswire/ -- ElcomSoft Co. Ltd. releases a major update of Elcomsoft System Recovery, a bootable tool for unlocking Windows accounts and accessing encrypted volumes. Version 6.0 introduces a new workflow for full-disk encryption, allowing to quickly extract information required to launch password recovery attacks on volumes encrypted with BitLocker, PGP and TrueCrypt/VeraCrypt. In addition, the tool can extract the computer's hibernation file to allow instant access to information stored in crypto containers.

Full Disk Encryption Workflow with Faster Access to Critical Evidence

Elcomsoft System Recovery 6.0 changes the way forensic experts access evidence stored on computers protected with full disk encryption, offering a simpler and faster approach for accessing evidence stored on encrypted computers. The traditional acquisition approach requires disassembling the computer, removing and imaging all of its storage devices. Elcomsoft System Recovery allows starting the investigation faster by booting the computer from a portable flash drive with read-only access to computer's storage devices. The tool automatically detects full disk encryption on all built-in and removable drives, allowing experts to extract information required to brute-force the original password to encrypted disk volumes with Elcomsoft Distributed Password Recovery.

Full-disk encryption passwords can be difficult to break. A quicker alternative to brute-forcing the password might be available in a case the computer was hibernated while the encrypted partition was mounted. If this is the case, the decryption key could be stored in the system's hibernation file. This decryption key can be quickly extracted and used to instantly mount or decrypt the encrypted volume with Elcomsoft Forensic Disk Decryptor without a lengthy attack.

Compatibility

Elcomsoft System Recovery offers unprecedented compatibility by using genuine Windows PE environment. The tool creates a bootable Windows PE flash drive, allowing loading additional drivers if required. The tool is compatible with 32-bit and 64-bit BIOS and UEFI computers running all versions of Windows including the latest versions of Windows 10 and Windows Server 2019.

About Elcomsoft System Recovery

Elcomsoft System Recovery helps users and forensic expert recover or reset lost or forgotten passwords to Windows accounts. With instant access to locked and disabled accounts, Elcomsoft System Recovery can assign or revoke administrative privileges to user accounts, replace and recover account passwords. The ability to recover account passwords helps experts access EFS-encrypted files and folders, while the ability to extract hibernation files and password hashes from encrypted disk volumes offers faster access to protected evidence stored on encrypted partitions.

SOURCE ELCOMSOFT Co. Ltd.