Introduction

Top Next

Elcomsoft System Recovery helps system administrators reset or recover passwords to local Windows accounts and Microsoft Account in all versions of Windows, assign administrative privileges to any user account, reset expired passwords or export password hashes for offline recovery. The tool can detect encryption and create forensic disk images. Elcomsoft System Recovery is supplied with a bootable Windows PE environment.

Features and Benefits

•Ready to boot with Windows PE (Preinstallation Environment) licensed from Microsoft

•Recovers or resets user and administrative passwords

•Breaks 4-6 digit Windows Hello PIN codes on computers without a TPM

•Original password recovery may be possible to provide automatic access to EFS-encrypted files

•Unlocks and enables user and administrative accounts

•Assigns administrative privileges to any user account

•Resets or disables password expiry options

•Broad hardware compatibility and genuinely native FAT and NTFS support

•Genuine Windows GUI for convenient operation

•Supports Windows NT 4, Windows 2000, Windows XP, Windows Vista, Windows 7, Windows 8/8.1, Windows 10, Windows 11

•Supports Windows Windows Server 2000/2003/2008/2012/2016/2019/2022 (including Domain Administrator password and all users' passwords)

•Supports US and localized versions of Windows and multilingual user names and passwords

•Detects all Windows installations automatically

•An option to dump hashed passwords from SAM/SYSTEM files or Active Directory database for further analysis and off-line password recovery

•An option to dump Domain Cached Credentials

•Dumps encryption keys for protected drives

•Supports Microsoft Live! accounts

•Resets or searches for SYSKEY startup password

•Password reset for Domain Cached accounts

•Dumps disk encryption keys

•Unlocks BitLocker-encrypted drives

•Locates encrypted virtual machines and extract encryption metadata for subsequent password recovery

•Creates forensic disk or partition images

Ready to Boot, Instant Unlock

Elcomsoft System Recovery makes it easy to create a bootable CD image (ISO) or USB flash frive. No need to create a reach for a Windows setup disks to make one! ElcomSoft has licensed the Windows Preinstallation Environment (Windows PE) directly from Microsoft, allowing the company to distribute the completely working bootable Windows environment based on Windows 10.

If there are no EFS-encrypted files on your Windows account, an instant unlock option is the quickest and easiest way to gain access to user and administrative accounts. Elcomsoft System Recovery resets forgotten passwords with a new password supplied by you, allowing for immediate login without the time-consuming password recovery operations.

Broad Compatibility

Elcomsoft System Recovery bootable environment supports a variety of hardware components including the most popular hard disk controllers thanks to the native Windows drivers. Unlike the various emulation environments, Elcomsoft System Recovery is genuinely compatible with the latest revisions of Microsoft file systems, including the latest versions of the FAT (FAT32, exFAT) and NTFS.

Recovers Original Passwords

Elcomsoft System Recovery can attempt to attack and recover the original password with common passwords and dictionary attacks. Elcomsoft System Recovery checks the locations where system passwords are cached, often allowing for instant password recovery.

Offline password recovery is made possible by dumping hashed passwords from SAM/SYSTEM files or Active Directory database for further analysis off-line analysis. We recommend Elcomsoft Distributed Password Recovery for highly scalable, GPU-accelerated recovery of system passwords.