ElcomSoft Improves Full Disk Encryption Workflow, Allows Faster Access to Encrypted Evidence

ElcomSoft Co. Ltd. releases a major update of Elcomsoft System Recovery, a bootable tool for unlocking Windows accounts and accessing encrypted volumes. Version 6.0 introduces a new workflow for full-disk encryption, allowing to quickly extract information required to launch password recovery attacks on volumes encrypted with BitLocker, PGP and TrueCrypt/VeraCrypt. In addition, the tool can extract the computer’s hibernation file to allow instant access to information stored in crypto containers.

Read More: Drones Officially Allowed to Deliver a Variety of Items in Australia’s Canberra

Full Disk Encryption Workflow with Faster Access to Critical Evidence

Elcomsoft System Recovery 6.0 changes the way forensic experts access evidence stored on computers protected with full disk encryption, offering a simpler and faster approach for accessing evidence stored on encrypted computers. The traditional acquisition approach requires disassembling the computer, removing and imaging all of its storage devices. Elcomsoft System Recovery allows starting the investigation faster by booting the computer from a portable flash drive with read-only access to computer’s storage devices. The tool automatically detects full disk encryption on all built-in and removable drives, allowing experts to extract information required to brute-force the original password to encrypted disk volumes with Elcomsoft Distributed Password Recovery.

Full-disk encryption passwords can be difficult to break. A quicker alternative to brute-forcing the password might be available in a case the computer was hibernated while the encrypted partition was mounted. If this is the case, the decryption key could be stored in the system’s hibernation file. This decryption key can be quickly extracted and used to instantly mount or decrypt the encrypted volume with Elcomsoft Forensic Disk Decryptor without a lengthy attack.

Read More: World’s Largest Business Organization Partners with Perlin for Blockchain Adoption Across Its 45 Million Members

Compatibility

Elcomsoft System Recovery offers unprecedented compatibility by using genuine Windows PE environment. The tool creates a bootable Windows PE flash drive, allowing loading additional drivers if required. The tool is compatible with 32-bit and 64-bit BIOS and UEFI computers running all versions of Windows including the latest versions of Windows 10 and Windows Server 2019.

Read More: NASA TV Coverage Set for April 17 Cygnus Launch to International Space Station