Passware Kit Forensic

Passware Kit Forensic

All-in-one password recovery and encrypted evidence discovery solution

The complete electronic evidence decryption solution

Passware Kit Forensic is the complete electronic evidence discovery solution that reports all password-protected items on a computer and decrypts them.

Key Product Features

 

HIGHEST SPEED

Reports all password-protected items on a computer and gains access to these items using the fastest decryption and password recovery algorithms.

 

OVER 280 FILE TYPES

Instant decryption of BitLocker, TrueCrypt, VeraCrypt, FileVault2, and PGP hard disks, MS Office documents, instant recovery of passwords for websites, Windows and Mac users.

 

PORTABLE VERSION

Runs from a USB drive so you can perform a complete encrypted evidence discovery process without installing Passware Kit on a target PC.

Product Features

Passware Kit Agent for Linux

Linux version allows running a portable Passware Kit Agent from a bootable Linux USB drive on any system without installation

Cloud data acquisition

Passware Kit acquires backups and data from cloud services: Apple iCloud and iCloud Drive, MS OneDrive, and Dropbox.

64-bit version

Improved performance while processing thousands of files simultaneously and larger dictionary files

Batch processing

Runs password recovery for groups of files without manual intervention

BitLocker, TrueCrypt, VeraCrypt, FileVault2, PGP

Instantly decrypts hard disk images with live memory analysis or recovers their passwords with accelerated brute-force attacks

Integrated with Guidance EnCase v8

One-click password recovery directly from EnCase

Mobile Forensics

Recovers Passwords for Apple iPhone/iPad and Android backups, as well as Android images. Extracts data from Windows Phones' images. Integrated with Oxygen Forensic Suite

Recovers passwords for 280+ file types

Including MS Office, PDF, Zip & RAR, Quickbooks, FileMaker, Lotus Notes, and many other popular applications

Scans computers for encrypted evidence

Detects all the encrypted files & hard disc images, reports encryption type and decryption complexity

Live Memory Analysis

Extracts encryption keys for FileVault2, TrueCrypt, VeraCrypt, BitLocker, logins for Windows & Mac accounts from memory images & hibernation files.

GPU, TACC, Distributed Computing, and Rainbow Tables

Accelerated password recovery with multiple computers, NVIDIA & AMD GPUs, Tableau Password Recovery and TACC, and Rainbow Tables

System Requirements

Hardware
Microsoft Windows Vista, Server 2003/2008/2012, or Windows 7/8.x/10 (32-bit or 64-bit) installed and configured on your system
1 GHz processor (2.4 GHz recommended)
512 MB of RAM (1 GB recommended)
150 MB of free hard disk space (more if you use custom dictionaries)
Software
Passware software supports PC platforms only. However, it can recover passwords for some files created on Macintosh such as FileMaker. You can run Passware products on a Virtual PC or Parallels Desktop to unprotect your files.
For Windows Key, a Windows Setup CD (32-bit or 64-bit) is required, as well as a burning CD-RW drive in order to record a password reset CD instead of the USB disk.
To acquire a physical memory image of the target computer using Passware FireWire Memory Imager (used to recover BitLocker, TrueCrypt, PGP, MS Office encryption keys, Windows and Mac user passwords, and website logins), a FireWire cable is required. Both the target computer and the computer used for acquisition should have FireWire (IEEE 1394) ports. A USB flash drive for Passware FireWire Memory Imager should be 8 GB or more.

Passware Kit Forensic 2017 V.1

What’s New

2017 v.1 Updates

Instant FileVault2 decryption using data extracted from iOS backups

QuickBooks 2016 and 2017 support

Password recovery for 1Password for Mac Vaults

Dictionaries for Danish and Swedish languages

Screenshorts

DOWNLOAD EXTENDED DICTIONARY

 

DOWNLOAD PRODUCT SHEET

 

KNOWLEDGE BASE

Related Products

 

PASSWARE KIT BUSINESS

 

PASSWARE KIT FORENSIC LAB EDITION

 

HARDWARE ACCELERATION WITH TPR

 

Passware Kit Forensic 2019 v1

 

Introduces Password Exchange, improved distributed password recovery, GPU monitoring, and new dictionaries. The first to decrypt hidden TrueCrypt partitions and macOS Mojave APFS disks.

 

Passware Kit 2019 v1 introduces Password Exchange — a new opt-in service that provides access to the list of passwords found by Passware Kit users worldwide.

 

We’re continuing to improve capabilities of distributed password recovery. The new version introduces a built-in tool to view logs and detailed status information for Passware Kit Agents directly from Passware Kit, as well as GPU monitoring (temperature, load, and fan speed).

 

Passware Kit 2019 v1 supports decryption of macOS Mojave APFS disks and is the first software to decrypt hidden TrueCrypt partitions instantly by extracting encryption keys from memory images.

 

What’s New

 

 

Password Exchange

Password Exchange  is a new opt-in service available for Passware Kit Forensic customers.

It provides access to the list of passwords found by Passware Kit users worldwide, offering it as an advanced dictionary to improve chances of finding strong passwords.

It is also possible to use Password Exchange in air-gapped environments using manual export and import of human-readable text files.

Available in Passware Kit Forensic.

 

GPU monitoring

Passware Kit now monitors and displays GPU temperature, load, and fan speed, both for local and remote GPUs.

Available in all editions.

 

 

Easy access to Passware Kit Agent logs

Passware Kit 2019 v1 introduces a new built-in tool to view logs and detailed status information for Passware Kit Agents.

Right-click any Passware Kit Agent and select “Show Details…” to view or export log files and review detailed Passware Kit Agent status information directly from Passware Kit.

It is also possible to filter a log file to display particular types of messages only, such as warnings, for easier performance troubleshooting.

Available in Passware Kit Forensic and Passware Kit Business.

 

 

Instant decryption of TrueCrypt hidden partitions

Passware Kit is the first tool that instantly decrypts hidden TrueCrypt partitions by extracting encryption keys from memory images or hibernation files.

Available in Passware Kit Forensic and Passware Kit Business.

 

 

Decryption of macOS Mojave APFS disks

Passware Kit now fully supports macOS Mojave and decrypts APFS disk images via live memory analysis and GPU-accelerated password recovery.

Available in Passware Kit Forensic and Passware Kit Business.

 

 

Additional dictionaries: Romanian, Bulgarian, Irish

This version of Passware Kit comes with three new wordlists for the Dictionary attack: Romanian, Bulgarian, and Irish. The software now provides 19 built-in dictionaries in total.

Available in all editions.