Elcomsoft System Recovery Professional Edition 8.31.1157 WinPE
Elcomsoft System Recovery helps system administrators reset or recover passwords to local Windows accounts and Microsoft Account in all versions of Windows, assign administrative privileges to any user account, reset expired passwords or export password hashes for offline recovery. The tool can detect encryption and create forensic disk images. Elcomsoft System Recovery is supplied with a bootable Windows PE environment.
Reset or recover passwords to local Windows accounts and Microsoft Account in all versions of Windows. Assign administrative privileges to any user account, reset expired passwords or export password hashes for offline recovery. Create forensic disk images.
Improved Full-Disk Encryption Workflow
Elcomsoft System Recovery makes it easier to access data stored in encrypted disks and containers. With automatic detection of encrypted volumes, ESR will automatically extract hashes required to launch an attack on the password of the encrypted volume, saving them to the flash drive to offer faster access to encrypted evidence compared to the traditional workflow. In addition, ESR can extract and save hibernation files that may contain the encryption keys to access information stored in encrypted volumes. These keys can be used to instantly mount encrypted volumes or decrypt their content for offline analysis.
Reset or Recover Windows Account Passwords
Up to 40% of support calls are related to forgotten passwords and locked logins. Elcomsoft System Recovery helps instantly reset Windows system passwords, enabling system administrators regain access to locked Windows accounts. Supporting local Windows accounts, network domains and Microsoft Account, Elcomsoft System Recovery is a must-have tool for network administrators, IT professionals and security specialists.
Reset or Recover SYSKEY Passwords
SYSKEY passwords were a dubious and controversial way to add an extra layer of security to Windows login. Used in older versions of Windows, SYSKEY passwords were removed from Windows 10 and Windows Server 2016 release 1709. An unknown SYSKEY password blocks Windows startup and prevents the ability to recover or reset the user’s account password.
Elcomsoft System Recovery can reset SYSKEY passwords in order to restore the system’s normal boot operation. Before resetting a SYSKEY password, ESR will now check whether this operation is safe for the system.
In addition, Elcomsoft System Recovery allows looking up for cached SYSKEY passwords in various system databases and cache files before resetting.
Instant Reset and Configurable Attacks
Elcomsoft System Recovery can reset account passwords instantly, while supporting pre-configured attacks to recover the original passwords. In addition, users can upload their own custom dictionaries for high-performance dictionary attacks with up to 4 levels of mutations.
Elcomsoft System Recovery unlocks locked and disabled user and administrative accounts in Windows 7, 8, 8.1, Windows 10, as well as many legacy versions of Windows including Windows Vista, Windows XP, Windows 2000, Windows NT as well as the corresponding Server versions up to and including Windows Server 2019. Both 32-bit and 64-bit systems are supported.
Ready to Boot, Immediate Assistance, Easy to Operate
Elcomsoft System Recovery comes with everything to quickly create a bootable DVD or USB flash drive. The image is based on a customized Windows PE environment, and comes pre-configured with a number of drivers to allow seamless experience on most legacy and cutting-edge hardware configurations.
Create a bootable USB drive or DVD disc in a few easy steps for immediate assistance. Elcomsoft System Recovery comes with 32-bit and 64-bit UEFI and legacy BIOS configurations, allowing you to create bootable media for all types of systems.
The genuine Windows PE environment offers complete access to the familiar Windows graphical user interface. No command line scripts and no poor imitations of the Windows GUI!
Feature List
Windows versions support
- Supports Windows XP/Vista/7, Windows 8/8.1, Windows 10, Windows 11
- Supports Windows NT/2000/XP workstations
- Supports Windows NT/2000/2003-2022 servers
- Creates bootable media for 32-bit и 64-bit BIOS
- Creates bootable media for 32-bit и 64-bit UEFI
- Supports Windows 8/8.1/10 Live! (Microsoft) accounts
General features
- Based on Windows PE
- Create bootable CD or USB flash drive
- Collect crucial evidence and establish digital chain of custody
- Create verifiable forensic disk images
- Reset password to user accounts
- Dump password hashes for local and domain accounts for further recovery
Advanced features
- In-place recovery of 4 through 6-digit Windows Hello PIN codes on systems without a TPM
- Locate encrypted virtual machines and extract encryption metadata for subsequent password recovery
- Extract Wi-Fi passwords
- Reveals Windows license keys
- Browse the file system, copy and view files with two-panel file manager
- Multilingual user interface
- Supports all RAID/SCSI/SATA devices
- Automatic mode (list of installed systems)
- Manual mode (browse for Registry files)
- Reset local Administrator password
- Backup/restore SAM
- Enable/unlock Administrator account
- Unlock BitLocker volumes (if one of the disk protectors is known or available)
- Create bootable media for macOS computers
- Extract hash dumps from TrueCrypt, VeraCrypt, Bitlocker, FileVault (HFS+/APFS), PGP Disk, LUKS and LUKS2 encrypted disks
- Extract password hints and control questions and answers
- Reset passwords to cached AD credentials
- Highlight accounts with Administrator rights
- Look up account privileges
- Enable/unlock disabled/locked accounts
- Give Administrator privileges to any user account
- Recover passwords for some system accounts
- Reset Domain Administrator password
- Dump password hashes for AD accounts
- Backup/restore NTDS.DIT
- Show LM/NTLM hashes
- Show password history hashes
- Test short and simple passwords
- SAM database editor
- Reset SYSKEY security
- Look up SYSKEY passwords
Bootable forensic tools streamline on-the-spot analysis
Forensically sound extractions and verifiable disk images
Improved Full-Disk Encryption Workflow
Elcomsoft System Recovery makes it easier to access data stored in encrypted disks and containers. With automatic detection of encrypted volumes, ESR will automatically extract hashes required to launch an attack on the password of the encrypted volume, saving them to the flash drive to offer faster access to encrypted evidence compared to the traditional workflow. In addition, ESR can extract and save hibernation files that may contain the encryption keys to access information stored in encrypted volumes. These keys can be used to instantly mount encrypted volumes or decrypt their content for offline analysis.
Encrypted Virtual Machines
In the world of hi-tech crime, encrypted virtual machines become one the most widely used cover-up tools. Manually locating such virtual machines can be an involving and time-consuming process. We made your work easier by finding many types of encrypted virtual machines automatically. Better yet, ESR will automatically capture the encryption metadata you’ll need to launch the attack on the VM encryption password in Elcomsoft Distributed Password Recovery.
Reset or Recover Windows Account Passwords
Up to 40% of support calls are related to forgotten passwords and locked logins. Elcomsoft System Recovery helps instantly reset Windows system passwords, enabling system administrators regain access to locked Windows accounts. Supporting local Windows accounts, network domains and Microsoft Account, Elcomsoft System Recovery is a must-have tool for network administrators, IT professionals and security specialists.
Reset or Recover SYSKEY Passwords
SYSKEY passwords were a dubious and controversial way to add an extra layer of security to Windows login. Used in older versions of Windows, SYSKEY passwords were removed from Windows 10 and Windows Server 2016 release 1709. An unknown SYSKEY password blocks Windows startup and prevents the ability to recover or reset the user’s account password.
Elcomsoft System Recovery can reset SYSKEY passwords in order to restore the system’s normal boot operation. Before resetting a SYSKEY password, ESR will now check whether this operation is safe for the system.
In addition, Elcomsoft System Recovery allows looking up for cached SYSKEY passwords in various system databases and cache files before resetting.
Instant Reset and Configurable Attacks
Elcomsoft System Recovery can reset account passwords instantly, while supporting pre-configured attacks to recover the original passwords. In addition, users can upload their own custom dictionaries for high-performance dictionary attacks with up to 4 levels of mutations.
Elcomsoft System Recovery unlocks locked and disabled user and administrative accounts in Windows 7, 8, 8.1, Windows 10, as well as many legacy versions of Windows including Windows Vista, Windows XP, Windows 2000, Windows NT as well as the corresponding Server versions up to and including Windows Server 2019. Both 32-bit and 64-bit systems are supported.
Ready to Boot, Immediate Assistance, Easy to Operate
Elcomsoft System Recovery comes with everything to quickly create a bootable DVD or USB flash drive. The image is based on a customized Windows PE environment, and comes pre-configured with a number of drivers to allow seamless experience on most legacy and cutting-edge hardware configurations.
Create a bootable USB drive or DVD disc in a few easy steps for immediate assistance. Elcomsoft System Recovery comes with 32-bit and 64-bit UEFI and legacy BIOS configurations, allowing you to create bootable media for all types of systems.
The genuine Windows PE environment offers complete access to the familiar Windows graphical user interface. No command line scripts and no poor imitations of the Windows GUI!
Case Studies
Elcomsoft System Recovery is an all-in-one security tool for Windows accounts. The tool helps detect and resolve a variety of issues related to user and administrative account passwords.
- Perform forensically sound data collection
- Do in-field analysis and disk imaging
- Collect court admissible evidence during in-field investigations
- Assign Administrator privileges to any user account
- Enable and unlock the locked and disabled user accounts
- Create forensic disk image for subsequent in-lab analysis
- Change and reset passwords for any local accounts
- List all local user accounts and highlight Administrator accounts
- Look up account privileges
- Detect accounts with empty passwords
- Instantly recover certain passwords to special/system accounts (e.g. IUSR_, HelpAssistant, etc)
- Backup and restore SAM/SYSTEM files
- Optionally restore original SAM/SYSTEM files after successful logon with a new password
Supports:
Windows 7, 8, 8.1, Windows 10, Windows 11; Windows Vista, Windows XP, Windows 2000, Windows NT; all relevant Windows Server versions; 32-bit and 64-bit systems; Windows PE with 32-bit and 64-bit UEFI and legacy BIOS configurations; familiar Windows GUI; SAM/SYSTEM and Active Directory
