Important compatibility notes

•You can view or change account properties (Administrator account, Account is locked/disabled, Password expired, Password never expires) for local user accounts only, but not for AD accounts.

•Some computers may require third-party mass storage drivers for RAID, SCSI, SAS and similar storage devices. You can load additional drivers after ESR was booted from a USB drive, or use drivers supplied with the program.

•If you use read-only media to boot ESR (such as a CD/DVD), you cannot save the password hashes back to the bootable disk. Use a different storage media for saving files.

Elcomsoft System Recovery is compatible with modern and legacy computers. While modern computers are equipped with UEFI, you may still encounter a PC that still uses the legacy BIOS. Some manufacturers shipping newer PCs equipped with UEFI are still using the term "BIOS" to avoid confusion. However, the vast majority of computers sold over the past decade are equipped with UEFI firmware instead of a BIOS.

If your computer runs UEFI, there are no special requirements to boot media. If, however, you are analyzing a legacy PC equipped with a BIOS, you will need to create a bootable media that is no larger than 32GB. There are some other restrictions to keep in mind when analyzing legacy BIOS PCs.

When creating a bootable media, ESR offers the choice of three boot options: BIOS, UEFI x64, and UEFI x32. You must select the correct option for the target computer. A vast majority of modern computers use UEFI x64, which is the default option. For legacy PCs, select BIOS. The last option, UEFI x32, is used in a few special cases such as some thin-and-light devices and nettops built on certain generations of the Intel Atom platform which, while supporting 64-bit instructions, are limited to the 32-bit instruction set.

Requirements for booting leagacy BIOS computers

There are special requirements when booting legacy BIOS computers from USB media, as defined by Microsoft for Windows PE.

•The size of the USB media cannot be smaller than 256 megabytes.

•The size of the USB media cannot be larger than 32 GB.

•The USB media must report a drive type of Removeable, not Fixed.

•The USB media must be the first in the list of boot devices in the computer BIOS.

•The computer BIOS must support the extended INT 13h (xINT13) BIOS interrupt for USB media.

•The computer BIOS must support booting from USB media.

•The computer's USB controller must support bulk-only transport (BOT).

Please note that these requirements do not apply to reasonably modern computers equipped with UEFI. To give an idea, manufacturers started using UEFI instead of a BIOS some time around 2007.

ESR has been designed for maximum compatibility and should be able to boot even from external hard disk (USB or FireWire) including ones that are larger than 32 GB, but some restrictions still apply.

Please note that after you reset the password, you may lose access to the user's: web page credentials, file share credentials, DPAPI encrypted stuff, EFS-encrypted files and certificates with private keys (signed/encrypted e-mail).