Passware Kit Forensic
All-in-one password recovery and encrypted evidence discovery solution
The complete electronic evidence decryption solution
Passware Kit Forensic is the complete electronic evidence discovery solution that reports all password-protected items on a computer and decrypts them.
Key Product Features
HIGHEST SPEED
Reports all password-protected items on a computer and gains access to these items using the fastest decryption and password recovery algorithms.
OVER 280 FILE TYPES
Instant decryption of BitLocker, TrueCrypt, VeraCrypt, FileVault2, and PGP hard disks, MS Office documents, instant recovery of passwords for websites, Windows and Mac users.
PORTABLE VERSION
Runs from a USB drive so you can perform a complete encrypted evidence discovery process without installing Passware Kit on a target PC.
Product Features
Passware Kit Agent for Linux
Linux version allows running a portable Passware Kit Agent from a bootable Linux USB drive on any system without installation
Cloud data acquisition
Passware Kit acquires backups and data from cloud services: Apple iCloud and iCloud Drive, MS OneDrive, and Dropbox.
64-bit version
Improved performance while processing thousands of files simultaneously and larger dictionary files
Batch processing
Runs password recovery for groups of files without manual intervention
BitLocker, TrueCrypt, VeraCrypt, FileVault2, PGP
Instantly decrypts hard disk images with live memory analysis or recovers their passwords with accelerated brute-force attacks
Integrated with Guidance EnCase v8
One-click password recovery directly from EnCase
Mobile Forensics
Recovers Passwords for Apple iPhone/iPad and Android backups, as well as Android images. Extracts data from Windows Phones' images. Integrated with Oxygen Forensic Suite
Recovers passwords for 280+ file types
Including MS Office, PDF, Zip & RAR, Quickbooks, FileMaker, Lotus Notes, and many other popular applications
Scans computers for encrypted evidence
Detects all the encrypted files & hard disc images, reports encryption type and decryption complexity
Live Memory Analysis
Extracts encryption keys for FileVault2, TrueCrypt, VeraCrypt, BitLocker, logins for Windows & Mac accounts from memory images & hibernation files.
GPU, TACC, Distributed Computing, and Rainbow Tables
Accelerated password recovery with multiple computers, NVIDIA & AMD GPUs, Tableau Password Recovery and TACC, and Rainbow Tables
System Requirements
Hardware
Microsoft Windows Vista, Server 2003/2008/2012, or Windows 7/8.x/10 (32-bit or 64-bit) installed and configured on your system
1 GHz processor (2.4 GHz recommended)
512 MB of RAM (1 GB recommended)
150 MB of free hard disk space (more if you use custom dictionaries)
Software
Passware software supports PC platforms only. However, it can recover passwords for some files created on Macintosh such as FileMaker. You can run Passware products on a Virtual PC or Parallels Desktop to unprotect your files.
For Windows Key, a Windows Setup CD (32-bit or 64-bit) is required, as well as a burning CD-RW drive in order to record a password reset CD instead of the USB disk.
To acquire a physical memory image of the target computer using Passware FireWire Memory Imager (used to recover BitLocker, TrueCrypt, PGP, MS Office encryption keys, Windows and Mac user passwords, and website logins), a FireWire cable is required. Both the target computer and the computer used for acquisition should have FireWire (IEEE 1394) ports. A USB flash drive for Passware FireWire Memory Imager should be 8 GB or more.
Passware Kit Forensic 2017 V.1
What’s New
2017 v.1 Updates
Instant FileVault2 decryption using data extracted from iOS backups
QuickBooks 2016 and 2017 support
Password recovery for 1Password for Mac Vaults
Dictionaries for Danish and Swedish languages
Screenshorts
Resources
DOWNLOAD EXTENDED DICTIONARY
DOWNLOAD PRODUCT SHEET
KNOWLEDGE BASE
Related Products
PASSWARE KIT BUSINESS
PASSWARE KIT FORENSIC LAB EDITION
HARDWARE ACCELERATION WITH TPR
Passware Kit Forensic 2019 v1
Introduces Password Exchange, improved distributed password recovery, GPU monitoring, and new dictionaries. The first to decrypt hidden TrueCrypt partitions and macOS Mojave APFS disks.
Passware Kit 2019 v1 introduces Password Exchange — a new opt-in service that provides access to the list of passwords found by Passware Kit users worldwide.
We’re continuing to improve capabilities of distributed password recovery. The new version introduces a built-in tool to view logs and detailed status information for Passware Kit Agents directly from Passware Kit, as well as GPU monitoring (temperature, load, and fan speed).
Passware Kit 2019 v1 supports decryption of macOS Mojave APFS disks and is the first software to decrypt hidden TrueCrypt partitions instantly by extracting encryption keys from memory images.
What’s New
Password Exchange
Password Exchange is a new opt-in service available for Passware Kit Forensic customers.
It provides access to the list of passwords found by Passware Kit users worldwide, offering it as an advanced dictionary to improve chances of finding strong passwords.
It is also possible to use Password Exchange in air-gapped environments using manual export and import of human-readable text files.
Available in Passware Kit Forensic.
GPU monitoring
Passware Kit now monitors and displays GPU temperature, load, and fan speed, both for local and remote GPUs.
Available in all editions.
Easy access to Passware Kit Agent logs
Passware Kit 2019 v1 introduces a new built-in tool to view logs and detailed status information for Passware Kit Agents.
Right-click any Passware Kit Agent and select “Show Details…” to view or export log files and review detailed Passware Kit Agent status information directly from Passware Kit.
It is also possible to filter a log file to display particular types of messages only, such as warnings, for easier performance troubleshooting.
Available in Passware Kit Forensic and Passware Kit Business.
Instant decryption of TrueCrypt hidden partitions
Passware Kit is the first tool that instantly decrypts hidden TrueCrypt partitions by extracting encryption keys from memory images or hibernation files.
Available in Passware Kit Forensic and Passware Kit Business.
Decryption of macOS Mojave APFS disks
Passware Kit now fully supports macOS Mojave and decrypts APFS disk images via live memory analysis and GPU-accelerated password recovery.
Available in Passware Kit Forensic and Passware Kit Business.
Additional dictionaries: Romanian, Bulgarian, Irish
This version of Passware Kit comes with three new wordlists for the Dictionary attack: Romanian, Bulgarian, and Irish. The software now provides 19 built-in dictionaries in total.
Available in all editions.