Most people meet these four tools one product page at a time, which makes them look like four separate purchases for four separate problems. On a real desktop case they are closer to four stages of a single job. Each one hands its output to the next: Elcomsoft System Recovery and Elcomsoft Quick Triage pull the raw material off the machine, Forensic Disk Decryptor turns keys into mounted volumes, and Distributed Password Recovery grinds through whatever is left. In this article we will not go through the feature lists (the product pages do that job well enough); instead we will look at when to reach for each tool, and why the order in which you use them is not fixed but decided by the situation in front of you.

If you have read Password Recovery and Data Decryption: Getting Around and About, the logic here will feel familiar. The idea is the same: try the least resource-intensive method first, and leave the brute force for the end. The four tools in the Desktop Forensic Bundle are simply that idea packaged as a pipeline.

Two questions decide the order

When you arrive at a machine, your immediate thought is often “I need to break a bunch of passwords”. In practice that is the last thing you want to do, and whether you have to do it at all depends on two questions you answer at the scene.

The first: is the machine on or off? A running, unlocked system is holding things a powered-off one is not, most importantly the encryption keys sitting in RAM while a volume is mounted. Power it down and much of that is gone. So the state of the machine when you walk up to it decides which tool goes first.

The second: if the system disk is encrypted (assuming BitLocker), do you have a key, or do you need to find one? Can you use a bypass? Every encrypted volume you hit sends you down one of two roads. If a key is within reach (from memory, from a hibernation file, from an escrow or recovery key, or because you already know the password), you decrypt and move on in seconds. If not, your options can be limited as attacking BitLocker system disk encryption is not a simple matter of extracting a piece of metadata and handing it to a GPU cluster.

Keep those two questions in mind and the four tools mostly sort themselves.

Stage 1: getting onto the machine

Many things depend on what exactly you have before you: an authenticated user session? A locked or hibernated computer? A machine that was abruptly pulled from the power grid? The answer changes everything.

The machine is running and unlocked: Quick Triage first

This is the good case, and it is also the one where haste actually pays off. Elcomsoft Quick Triage runs against the live session and collects the high-value artifacts (saved browser and email passwords, history, messenger data, documents, Windows credentials, DPAPI-protected items) into a single open VHDX container. It indexes as it goes, so you can search across everything on the spot and decide whether this box is worth a full acquisition or not. We wrote more about the tool itself in Introducing Elcomsoft Quick Triage.

The part that is genuinely time-sensitive: if encrypted volumes are mounted right now, their keys are in memory. Elcomsoft Quick Triage can capture a memory image, and so can Forensic Disk Decryptor with its own kernel-level RAM imager. Grab that dump before anything is powered off. This is the difference between mounting the container in a few seconds later on and attacking it for weeks, and it is the one window that does not reopen once the machine goes dark. The same reasoning applies to running virtual machines, whose volatile images live in RAM as well. For the background on pulling live keys, see Live System Analysis: Extracting BitLocker Keys.

Not sure whether there are any encrypted volumes to begin with? The free Encrypted Disk Hunter answers that in one pass before you commit to pulling the plug. While we’re at it, check out the other Free forensic tools we have to offer.

The machine is off, or you have no working login: System Recovery

No live session means no keys in RAM, so the priority shifts to a clean acquisition. Elcomsoft System Recovery boots the target from your USB stick into a Windows PE environment that comes up read-only by default; nothing touches the original disk unless you deliberately clear the write-blocking option. From there you can:

1. Image the built-in storage to E01 (or RAW/DD) with a hash written alongside, so the acquisition holds up later on.
2. Reset or recover Windows, Microsoft Account, Entra ID or domain passwords if you actually need to sign in, or dump the hashes for offline work.
3. Detect encrypted volumes and encrypted virtual machines automatically, and export their encryption metadata, which is the small file Distributed Password Recovery needs to start an attack.
4. Pull hibernation and page files. Even on a cold machine these can still hold encryption keys from the last time a container was mounted, which is a lead for the next stage rather than the end of the road.

Elcomsoft System Recovery also runs its own artifact sweep (registry, event logs, credentials, DPAPI keys), so you can make the keep-or-image decision on-site instead of hauling everything back and looking blind. There is more on this in Elcomsoft System Recovery: A Swiss Army Knife of Desktop Forensics.

A word on the overlap: Elcomsoft System Recovery and Elcomsoft Quick Triage both collect artifacts, and that is deliberate, not redundant. Elcomsoft System Recovery works from outside a booted OS (machine off, or no working credentials); Elcomsoft Quick Triage works from inside a live session (machine on and unlocked). You choose based on how you found the machine, not on which of the two you happen to own.

Stage 2: dealing with the encryption

By now you have a disk image, an encrypted container, or a memory dump. Which road you take depends entirely on whether a key is within reach.

You have a key: Forensic Disk Decryptor

Elcomsoft Forensic Disk Decryptor takes any of the following and gives you the data:

1. an encryption key pulled from a RAM dump or a hibernation file, captured while the volume was mounted;
2. an escrow or recovery key (BitLocker recovery keys live in Active Directory or in the user’s Microsoft Account; FileVault 2 keys may come out of iCloud);
3. or a plain-text password, if you already have it.

Feed it one of those and you either decrypt the whole container or mount it as a drive letter for real-time, read-as-you-go access. It covers BitLocker (including BitLocker To Go and TPM setups), FileVault 2 on HFS+ and APFS, PGP Disk, TrueCrypt, VeraCrypt, LUKS/LUKS2 and Jetico BestCrypt. This is the fast lane: no attack, no waiting.

You have no key: extract the metadata, hand it to Distributed Password Recovery

If there is no key to be found anywhere, Forensic Disk Decryptor (or Elcomsoft System Recovery) extracts the encryption metadata, a tiny file, and that is what goes to the password recovery stage. Worth pointing out for anyone handling sensitive material: only that small piece of metadata leaves the machine, never the encrypted data itself, so you can push it to a remote or cloud cluster without the content going along with it.

Stage 3: recovering the passwords

Elcomsoft Distributed Password Recovery is the heavy end of the pipeline, and it is where everything the other three collected gets cashed in:

1. container metadata from Forensic Disk Decryptor or Elcomsoft System Recovery feeds a GPU-accelerated attack on the volume password;
2. Windows hashes (LM/NTLM/DCC) from Elcomsoft System Recovery or Elcomsoft Quick Triage feed account password recovery (and NTLM is one of the fastest formats to attack, as shown in Windows Account Passwords: Why and How to Break NTLM Credentials);
3. encrypted VM metadata from Elcomsoft System Recovery feeds the VMware, VirtualBox or Parallels password;
4. documents, archives, PDFs and password-manager vaults, some 300-plus formats, go in directly.

Elcomsoft Distributed Password Recovery scales across GPUs and across machines with effectively linear speed-up, and once it has the metadata it runs offline, which is the whole reason we extract hashes instead of shipping data around.

One habit worth building in at this point is the “low hanging fruit” approach we keep coming back to (see May the [Brute] Force Be with You). Everything Elcomsoft Quick Triage and Elcomsoft System Recovery recovered along the way, the browser passwords, Wi-Fi keys, password hints and security answers, makes excellent material for a custom dictionary. People reuse and mutate their passwords far more than they’d like to admit, so trying what you already know about the subject before launching a blind brute force turns a good number of “weeks” into “minutes”. In effect, the earlier tools build Distributed Password Recovery wordlist for you. When it comes to ordering the attacks themselves, Building a Password Recovery Queue covers how to arrange the queue so the fast attacks run first.

The short version

Here’s a brief summary:

Read top to bottom it looks like four stages, acquire, triage, decrypt, recover, but you rarely walk all four in a straight line. You branch on machine state at the top and on key availability in the middle, and quite often you are done by the end of stage two without ever touching a brute-force attack.

Conclusion

The main reason these four tools ship as a bundle is the discount, of course, as the bundle does come out well ahead of buying the tools one at a time on a single, synchronized license period. But it is also that the handoffs are built in. Elcomsoft System Recovery and Forensic Disk Decryptor export encryption metadata in the exact format Distributed Password Recovery expects. The keys Elcomsoft Quick Triage and Forensic Disk Decryptor scrape out of memory are what Forensic Disk Decryptor then mounts with. Own three of the four and sooner or later you hit the case that stalls because the tool that does the next step simply is not on the shelf.

Taken separately, each of these is a capable tool in its own right. Taken together, they are a pipeline, which is how the work actually runs.

Trial versions of Elcomsoft Quick Triage, Forensic Disk Decryptor and Distributed Password Recovery are available on their respective product pages if you would like to walk the workflow before committing.