Passware Kit Forensic

The complete electronic evidence discovery solution

Passware Kit Forensic is the complete electronic evidence discovery solution that reports all the password-protected items on a computer and decrypts them. The software recognizes 280+ file types and works in batch mode recovering their passwords.

Password recovery for 280+ file types
MS Office, PDF, Zip and RAR, Quickbooks, FileMaker, Lotus Notes, Apple iTunes Backup, Mac OS X Keychain and many other popular applications.

Live Memory analysys
Analyzes live memory images, hibernation files and extracts encryption keys for FileVault2, TrueCrypt, VeraCrypt, BitLocker, logins for Windows & Mac accounts from memory images & hibernation files.

Cloud Data Acquisition
Passware Kit acquires backups and data from cloud services: Apple iCloud and iCloud Drive, MS OneDrive, and Dropbox.

Mobile Forensics
Recovers passwords for Apple iPhone/iPad and Android backups as well as Android images and extracts data from images on Windows phones. Integrated with the Oxygen Forensic Suite.

Hardware Acceleration
Accelerated password recovery with multiple computers, NVIDIA and AMD GPUs, Tableau Password Recovery and TACC, and Rainbow Tables.

Intelligent Detection
Detects all the encrypted files and hard disk images, reports encryption type and decryption complexity.

Linux Agent Ready
Run a portable Passware Kit Agent from a bootable Linux USB drive.

Decryption of FDE
Decrypts or recovers passwords for BitLocker, FileVault2, TrueCrypt, VeraCrypt, LUKS, McAfee, Apple DMG, and PGP disk images.

System Requirements

Hardware:

• Microsoft Windows Vista, Server 2003/2008/2012, or Windows 7/8.x/10 (64-bit only) installed and configured
• 1 GHz processor (2.4 GHz recommended)
• 512 MB of RAM (1 GB recommended)
• 150 MB of free hard disk space (more if you use custom dictionaries)

Software:

Passware software supports PC platforms only. However, it can recover passwords for some FileMaker files created on Macintosh. You can run Passware products on a Virtual PC or Parallels Desktop to unprotect your files. For Windows Key, a Windows Setup CD (32-bit or 64-bit) is required, as well as a burning CD-RW drive in order to record a password reset CD instead of the USB disk. To acquire a physical memory image of the target computer using Passware FireWire Memory Imager (used to recover BitLocker, TrueCrypt, PGP, MS Office encryption keys, Windows and Mac user passwords, and website logins), a FireWire cable is required. Both the target computer and the computer used for acquisition should have FireWire (IEEE 1394) ports. A USB flash drive for Passware FireWire Memory Imager should be 8 GB or more.