Elcomsoft System Recovery update simplifies digital field triage

Elcomsoft System Recovery, a digital field triage tool, receives an update. The tool adds the ability to extract Wi-Fi passwords and helps identify the owner of the computer being examined by extracting its Windows license key. In addition, file system analysis is made easier with an embedded two-panel file manager.

We updated Elcomsoft System Recovery with host of features aimed at making in-field investigations more efficient and straightforward. The new release reveals password hints from local Windows accounts for subsequent analysis. In addition, the tool can extract security questions and answers in Windows 10, adding valuable information to the investigation.

The latest build adds the ability to extract Wi-Fi passwords. Together with other types of passwords, the Wi-Fi passwords can be added to a highly targeted custom dictionary that can be used to break strong encryption and attack passwords protecting encrypted documents, disks and accounts.

This release adds ability to reveal Windows product keys, enabling investigators to request Microsoft for information about the owner of the license, which may be a great deal of help when examining a computer from a crime scene.

Another piece of information extractable in the field are password hints, questions and answers aimed at helping users recall their forgotten passwords. Examiners can use password hints and QA to re-create the user’s original passwords and make targeted dictionaries for password attacks.

Finally, Elcomsoft System Recovery now bundles FAR, one of the most convenient two-panel file managers. The now embedded Far Manager is an open-source tool for navigating the file system and managing files and archives. Far Manager works in text mode and provides a simple and intuitive way for performing the most common actions such as viewing files and directories, accessing hidden and system items, copying data and accessing archives.

Elcomsoft System Recovery is indispensable for computer forensic experts as a tool for digital field triage. The tool comes as a pre-configured tool integrated with the supplied Windows PE environment and includes a convenient two-panel file manager for easier navigation around the file system. The tool can reset Windows account passwords instantly, while supporting a range of smart pre-configured attacks to recover the original passwords.

Elcomsoft System Recovery 7.08 change log: