Elcomsoft System Recovery Introduces Write-Blocking, Digitally Signed Disk Imaging

ElcomSoft Co. Ltd. updates Elcomsoft System Recovery, a bootable tool for unlocking Windows accounts, accessing encrypted volumes and unlocking encrypted virtual machines. The new release introduces write-blocking, digitally signed disk imaging, helping experts establish digital chain of custody during in-field investigations.

“The already powerful tool can now maintain digital chain of custody”, says Vladimir Katalov, Elcomsoft CEO. “The combination of write-blocking access and digitally signed disk images make Elcomsoft System Recovery a viable alternative to hardware-based write blocking disk imaging devices while offering a faster and easier forensic analysis workflow.”

Write-Blocking Disk Access

Elcomsoft System Recovery 8.0 helps producing court admissible evidence with write-blocking mode and read-only disk imaging. The write-blocking mode is engaged by default during the first steps of running Elcomsoft System Recovery, ensuring that no data is modified on the target computer.

In this mode, experts can image disks and partitions, locate encrypted disks and extract encryption metadata, and use the supplied two-panel file manager to analyze the file system. From this release onwards, write-blocking disk access becomes the tool’s default behavior. Experts will have to explicitly untick the “read-only” check box to access system management functionality such as resetting Windows user and administrative passwords.

Digitally Signed Disk Imaging

The new release introduces the ability to image connected disks into digitally signed .E01 images. Together with read-only imaging, the use of digital signatures helps establish digital chain of custody, while employing the industry-standard .E01 format makes the images compatible with third-party forensic tools for comprehensive analysis.

About Elcomsoft System Recovery

Elcomsoft System Recovery is a digital triage tool for examining computers in the field. The tool helps overcome the challenge of accessing a locked system, delivering a straightforward workflow for investigating computers in the field. Elcomsoft System Recovery helps access information in encrypted disks and encrypted virtual machines, extract passwords and access encrypted file systems.

About ElcomSoft Co. Ltd.

Founded in 1990, ElcomSoft Co.Ltd. is a global industry-acknowledged expert in computer and mobile forensics providing tools, training, and consulting services to law enforcement, forensics, financial and intelligence agencies. ElcomSoft pioneered and patented numerous cryptography techniques, setting and exceeding expectations by consistently breaking the industry’s performance records. ElcomSoft is Microsoft Certrified Partner (Gold competency), and Intel Software Premier Elite Partner.