Elcomsoft System Recovery 8.36 adds Windows Server 2025 support, BitLocker key exporting, and enhanced SRUM analysis

This update introduces support for the newest Windows Server 2025 Active Directory database (ntds.dit), allowing investigators to extract, analyze, and recover credentials and directory data from up to date systems. Version 8.36 also adds the ability to export BitLocker keys discovered in the Active Directory database of Windows Server 2025, along with reporting, giving examiners the ability to identify, extract, and document recovery keys for encrypted volumes directly from the system under investigation💻

The update enhances Forensic Tools data export with new options to save extracted evidence in CSV and XML formats, in addition to the already available plain text exporting💡

More information on the website at the link ✍🏻
#ESR #updating

Choosing the Right Strategy: Cold Boot Forensics vs Live System Analysis🔎

The first steps of an investigation are rarely straightforward. Do you shut down the system and image the storage media, taking the safe but slow traditional path? Do you run a triage tool on the live system to grab passwords and keys, or do you reboot into a clean forensic environment?

Traditional wisdom might suggest pulling the plug to preserve the state of the disk, but modern encryption makes this increasingly difficult📊

During the initial stage of an investigation, the choice usually falls between two primary strategies: deploying a live triage tool on the running system or booting into a clean, external environment🖥

In this article, we look at the trade-offs between Elcomsoft Quick Triage and Elcomsoft System Recovery to help you decide which tool fits the scenario.

More in our new article📎

#EQT #ESR

Recovering Windows Credentials with Elcomsoft System Recovery❗️

In traditional forensic workflows, gaining access to a Windows system was a straightforward exercise: extract the NT hashes from a local database and run a fast (very fast!) offline attack.

Today, Windows authentication is moving away from those essentially insecure NTLM hashes toward more resilient mechanisms.

Microsoft is actively steering users away from local Windows accounts, pushing them toward cloud-integrated identities (such as the Microsoft Account) and hardware-backed security models (like Windows Hello).

💡We will examine the four primary sign-on options used in modern versions of Windows: legacy local Windows accounts, consumer Microsoft Accounts, traditional Active Directory environments, and Entra ID cloud configurations;

💡We will detail what credential extraction actually entails in each specific scenario;

💡Because the definition of a recoverable credential now varies depending on the account type, we will discuss exactly which data can be targeted, what can be recovered with an offline attack, and where traditional password recovery is no longer applicable.

More information at the link📎

#ESR