Elcomsoft System Recovery 8.0 - a forensically sound field analysis tool with write-blocking disk imaging

Elcomsoft System Recovery, a digital field triage tool, receives a major update. The new release gains write-blocking mode and brings support for .E01 forensic disk images. The new features make Elcomsoft System Recovery a forensically sound computer triage and field analysis tool.

We updated Elcomsoft System Recovery with features aimed at making in-field investigations more efficient and straightforward. The new release makes forensically sound field analysis possible with a new write-blocking disk imaging and read-only access to the data. In addition, disk images can now be saved in the digitally signed .E01 format, producing court admissible evidence and making subsequent analysis possible with third-party forensic tools.

The new write-blocking mode can be engaged during the initial steps of running Elcomsoft System Recovery to ensure that no data is modified on the target computer. In this mode, experts can image the disks, locate encrypted disks and extract encryption metadata, and use the supplied two-panel file manager to analyze the file system. Resetting Windows user passwords and performing other management tasks is unavailable in read-only mode, and will require read-write access.

Elcomsoft System Recovery is a portable field analysis tool for computer forensics. Built as a forensically sound computer analysis tool, Elcomsoft System Recovery enables experts to make real-time decisions in the field. Thanks to the Windows-based bootable environment, the tool provides quick access to digital evidence while supporting all the Windows native file systems and a wide array of computer hardware.

Designed for field deployment, Elcomsoft System Recovery comes as a pre-configured tool built on top of the supplied Windows PE environment. The tool includes powerful disk imaging and system management tools, and comes with a convenient two-panel file manager for easier navigation around the file system. Elcomsoft System Recovery is designed to simplify forensic computer triage with rapid data collection and secure disk imaging, making it an easy to use, forensically sound and extremely powerful triage tool.

Elcomsoft System Recovery 8.0 change log: