ElcomSoft System Recovery is a powerful tool designed to assist system administrators, IT professionals, and forensic experts in managing and recovering access to Windows systems.

• Forensically Sound Data Collection: Ensures the integrity of digital evidence by implementing read-only, write-blocking access to target computers, preserving the original data during investigations.
• Verifiable Disk Imaging: Creates digitally signed, verifiable disk images in industry-standard .E01 format, facilitating compatibility with third-party forensic tools and maintaining the digital chain of custody.
• Reset or Recover Windows Account Passwords: Instantly resets or recovers passwords for local Windows accounts, Microsoft Accounts, and network domains, enabling quick restoration of system access.
• Support for Encrypted Volumes: Identifies and mounts BitLocker-encrypted partitions using various disk protectors, allowing access to encrypted data when proper credentials are provided.
• Quick Forensic Tools: Provides built-in tools to review installed applications, analyze user timelines, and access recently used files and folders, streamlining on-site investigations.
• Broad Hardware Compatibility: Operates within a customized Windows PE environment with extensive driver support, ensuring seamless functionality across a wide range of hardware configurations.
• Bootable Media Creation: Facilitates the creation of bootable USB drives or DVDs with both 32-bit and 64-bit UEFI and legacy BIOS configurations, providing immediate assistance for system recovery tasks.
• Integrated Windows Event Log Viewer: Includes a built-in viewer for Windows event logs, enabling quick access to system activity records crucial for forensic analysis.
• Support for Multiple Windows Versions: Compatible with a wide range of Windows operating systems, including Windows 11, 10, 8.1, 8, 7, Vista, XP, 2000, and various Windows Server editions.
• Instant Unlock and Password Recovery: Offers options for instant password resets and configurable attacks to recover original passwords, including support for custom dictionaries and multiple attack levels.