Passware Kit Forensic Lab

LIVE MEMORY ANALYSIS
Extracts encryption keys for FileVault2, TrueCrypt, VeraCrypt, BitLocker, logins for Windows & Mac accounts from memory images & hibernation files.

CLOUD DATA ACQUISITION
Passware Kit acquires backups and data from cloud services: Apple iCloud and iCloud Drive, MS OneDrive, and Dropbox.

MOBILE FORENSICS
Recovers Passwords for Apple iPhone/iPad and Android backups, as well as Android images. Extract data from Windows Phones' images. Integrated with Oxygen Forensic Suite.

INTELLIGENT DETECTION
Detects all encrypted files & hard disk images, reports encryption type and decryption complexity.

DISTRIBUTED PASSWORD RECOVERY
Accelerate password recovery by distributing decryption tasks between multiple computers running Passware Kit Agents, in the local network, over the internet, or in the cloud.

LINUX AGENT READY
Run a portable Passware Kit Agent from a bootable Linux USB drive.

System Requirements

Hardware:

• Microsoft Windows Vista, Server 2003/2008/2012, or Windows 7/8.x/10 (64-bit only) installed and configured
• 1 GHz processor (2.4 GHz recommended)
• 512 MB of RAM (1 GB recommended)
• 150 MB of free hard disk space (more if you use custom dictionaries)

Software:

Passware software supports PC platforms only. However, it can recover passwords for some FileMaker files created on Macintosh. You can run Passware products on a Virtual PC or Parallels Desktop to unprotect your files. For Windows Key, a Windows Setup CD (32-bit or 64-bit) is required, as well as a burning CD-RW drive in order to record a password reset CD instead of the USB disk. To acquire a physical memory image of the target computer using Passware FireWire Memory Imager (used to recover BitLocker, TrueCrypt, PGP, MS Office encryption keys, Windows and Mac user passwords, and website logins), a FireWire cable is required. Both the target computer and the computer used for acquisition should have FireWire (IEEE 1394) ports. A USB flash drive for Passware FireWire Memory Imager should be 8 GB or more.