Elcomsoft System Recovery 8.0 Introduces Write-Blocking, Digitally Signed Disk Imaging

We updated Elcomsoft System Recovery with features improving the safety of in-field investigations. The new release introduces write-blocking, digitally signed disk imaging, helping experts establish digital chain of custody during in-field investigations.

Write-Blocking Disk Imaging

Elcomsoft System Recovery 8.0 helps producing court admissible evidence with write-blocking mode and read-only disk imaging. The write-blocking mode can be engaged during the initial steps of running Elcomsoft System Recovery to ensure that no data is modified on the target computer. In this mode, the tool attempts to mount the disks on the target computer in read-only mode.

In this mode, experts can image disks and partitions, locate encrypted disks and extract encryption metadata, and use the supplied two-panel file manager to analyze the file system. Thanks to the new write-blocking mode, Elcomsoft System Recovery becomes a viable alternative to hardware-based write blocking disk imaging devices while offering a faster and easier workflow compared to the traditional process.

From this release onwards, write-blocking disk access becomes the tool’s default behavior. Users will have to explicitly de-activate the “read-only” check box when accepting the License Agreement to access system management functionality such as resetting Windows user passwords.

Digitally Signed .E01 Images

Elcomsoft System Recovery 8.0 introduces the ability to image connected disks into digitally signed .E01 images. Together with read-only imaging, the use of digital signatures helps establish digital chain of custody, while the industry-standard .E01 format makes the images compatible with third-party forensic tools for comprehensive analysis.