Passware Kit Forensic

[tarekma7]

Passware Kit Forensic is the complete electronic evidence discovery solution that reports all password-protected items on a computer and decrypts them. The software recognizes 280+ file types and works in batch mode recovering their passwords. It can recover all kinds of passwords, for example Acrobat, Windows, WinZip, office application (such as Excel, Word, and so on) and many more. Some types of files are decrypted instantly, meanwhile others require Dictionary and Brute-force methods to be recovered. The built in encryption analyzer professional can find password-protected files on your computer system. The program has more than 30 password recovery modules integrated in one app which helps you even with difficult passwords

Homepage:

https://www.passware.com/kit-forensic/

System Requirements:

Windows Vista, Server 2003/2008/2012, or Windows 7/8.x/10 (32-bit or 64-bit), 1 GHz processor, 512 MB of RAM, 150 MB of free hard disk space
To record a password reset CD instead of the USB disk: Windows Setup CD (32-bit or 64-bit) and burning CD-RW drive
To acquire a physical memory image of the target computer (using Passware FireWire Memory Imager): FireWire cable is required. Both the target computer and the computer used for acquisition should have FireWire (IEEE 1394) ports. A USB flash drive for Passware FireWire Memory Imager should be 8 GB or more.

Current version:  2017 v2.0

Release date:  Apr. 13, 2017

Download:

You can download demo version from the official website which helps you to test the app features. After purchase download link for the retail version together with the license code will be emailed to you
Simply input your email to request the free demo version here:

https://www.passware.com/kit-forensic/freedemo/

Installation:

Double click on the installer and follow simple on screen instruction till the program is fully functional on your computer. You will be asked about your license key during installation

















Demo Limitations:

Recovers either the first three letters of passwords or passwords containing no more than three characters.
Allows each of the attacks to work for up to one minute.
For Windows Administrators, demo version resets a “Demo12345” password only.

User Interface:



Menus:

File:







View:



Tools:



Help:



Characteristics and program features:

All-in-one password recovery for 280+ file types
Integrated Encryption Analyzer Pro scans computers for password-protected items
Integrated Search Index Examiner retrieves electronic evidence from a Windows Desktop Search Database
Resets passwords for Local and Domain Windows Administrators
Instant online decryption of Word/Excel files (up to version 2003)
Multi-core CPUs acceleration
GPU acceleration for MS Office 2007 files
Basic password recovery attacks: Dictionary, Xieve, Brute-force, Known Password/Part, Previous Passwords
Password modifiers supported (casing, reverse words, etc.)
Combination of attacks for passwords like "strong123password"
Wizard for an easy setup of password recovery attacks
MD5 hash values for forensic reports

What are the new features in the current version?

Bugfixes:
•Revised MD5 hash report format for iCloud Backup
•Resolved an issue with BitLocker support
•Resolved an issue with TPR acceleration
•Resolved minor issue with SAM password recovery
•Resolved GPU acceleration issue for ZIP password recovery
•Minor GPU acceleration improvements

New Features:
Recovers passwords for iOS 10.2 iTunes backups, WPA/WPA2 WiFi connections.
Instantly extracts passwords stored in iOS Keychain.
Acquires images (including deleted ones) from iCloud Photo Library.
Improves performance while running on multi-GPU systems or using Distributed Password Recovery.

For the full changelog, visit this page:

https://www.passware.com/kit-forensic/whatsnew/

Comparison of different version:

https://www.passware.com/compare/



File types supported:

Over 280+ files supported. Instant decryption of BitLocker, TrueCrypt, FileVault2, and PGP hard disks, MS Office 2013 documents, instant recovery of passwords for websites, Windows and Mac users.

https://www.passware.com/kit-forensic/filetypes/

Let’s discuss the Key Features of Passware Kit Forensic:

Find all the password-protected or encrypted files on a PC, Mobile, or Local Network.

Scans computers for encrypted evidence:
Detects all the encrypted files & hard disk images, reports encryption type and decryption complexity

Recover or reset passwords for Windows, Word, Excel, QuickBooks, Zip, PDF, and more than 280 document types.

Recovers passwords for MS Office files, archives, PDF documents, Windows Server Administrators, financial databases, email accounts, and more.

Batch processing
Runs password recovery for groups of files without manual intervention

Live Memory analysis:
Extracts encryption keys for FileVault2, TrueCrypt, VeraCrypt, BitLocker, logins for Windows & Mac accounts from memory images, and hibernation files.

Cloud Data Acquisition:
Passware Kit acquires backups and data from cloud services: Apple iCloud and iCloud Drive, MS OneDrive, and Dropbox.

Mobile Forensics:
Recovers Passwords for Apple iPhone/iPad and Android backups, as well as Android images. Extracts data from Windows Phones' images. Integrated with Oxygen Forensic Suite.

Hardware Acceleration:
Accelerated password recovery with multiple computers, NVIDIA and AMD GPUs, Tableau Password Recovery and TACC, and Rainbow Tables.

Intelligent detection:
Detects all the encrypted files and hard disk images, reports encryption type and decryption complexity.

Linux Agent Ready:
Run a portable Passware Kit Agent from a bootable Linux USB drive.

64-bit version:
Improved performance while processing thousands of files simultaneously and larger dictionary files

Automatic Updates:
Automatic software updates with 1 year of free Software Maintenance and Support (SMS) subscription

Decrypts FDE
Decrypts or recovers passwords for BitLocker, TrueCrypt, LUKS, FileVault2, Apple DMG, and PGP disk images

Integrated with Guidance EnCase:
One-click password recovery directly from EnCase v8

Program Performance:

Passware provide the fastest decryption tools. It uses all the available computational resources efficiently, for example: multiple CPUs, NVIDIA and AMD GPUs, TPR and multiple computers. GPU (Graphics Processing Unit) cards help accelerate password recovery by up to 400 times, compared to CPU-only systems. Passware supports all types of NVIDIA (GTX, Tesla) and AMD GPUs. Up to 8 GPUs are supported per host computer.





Testing Password Recovery Settings:

Before using the app for password recovery, you can test recovery settings against a known passwords list.



When you launch the program, you will find many tools and features. I will discuss how to use each one

Recover File password:

Did you ever have been unable to open a file on your computer because you lost password. The program will help you recover passwords for many types of files. The program uses many types of attacks to discover the password (for example brute force, dictionary and many more). It will take time depending on the password strength. Once discovered, the password will be stored and you don’t need to use the attack again. Several reports and log files that track the program activity during recovery will be available













You can easily follow the progress on the main screen of the program or on the left sided bar information:



Find encrypted files:

You can scan the whole computer or local drives or document files only. Scan options include system folders, slow file types, encrypted containers, disk images and calculation of MD5. You can specify a custom location on your computer. You will have a list of the encrypted files with some details including location, type, encryption and how to recover. You can easily select to recover the password







Decrypting Hard Disk:

The program can be used to decrypt hard disks encrypted with BitLocker, TrueCrypt, PGP, FileVault 2, Apple Disk Utility, and LUKS. The program extract the encryption key from the memory image



Memory Analysis:

Using the program, you can easily extract passwords and encryption keys from live memory images and Windows hibernation files. This includes encryption keys for BitLocker, TrueCrypt, PGP, FileVault2; passwords for Windows and Mac users; passwords for websites and authentication data for Apple iCloud and Windows Phone. In addition, the program has a very useful built in feature which allows users to create physical memory images using Passware FireWire Memory Imager





Mobile and Cloud Forensics:

You can use the program to recover passwords for mobile backups and images. Icloud, one drive and dropbox backups download to your computer can be easily completed with the help of the program.





Internet and Network:

Did you try to access your email or network and can’t remember the password. Don’t panic , You can use the Passware Kit to recover your e-mail account, Internet, and Network connection passwords in an easy and quick way.



System and Registry:

The program will help you to extract passwords from external registry files. This feature offers you one of two options to select from. The first is to reset windows administrator password, the second is to recover passwords for standalone system. For example; windows account, email, network connection, website



How to create windows password reset disk? From the left bar of the main screen select create password reset and run a simple 4 step wizard to have a bootable CD or USB flash that help you to reset your windows password.



Portable version: The program can be used as a portable version either on USB Flash or on CD. USB flash is preferred and the program can be used as a regular version without causing any changes to the original file system or registry

Options:

Located under tools menu. These include; hardware, network, folders, updates, customer experience











Pros:

Recover file passwords
Recover or reset windows administrator password
Portable version
Recover network and email passwords
Search for encrypted files and find a solution to decrypt
And many more

Cons:

Expensive

Conclusion:

Passware delivers leading decryption tools. Passware Kit Forensic offers all in one solution for decryption of any type of encrypted files. The program supports a portable version. It is the most powerful tool that will help you to easily recover both simple and complex passwords. It has many tools and features which make it the most professional app in its category

[Mike]

Thanks for the nice detailed review Tarek.

[baziroll]

thanks for professional review

[asus73]

Graet review, thanks.  

[comphelp]

Thanks for this detailed review!

[scot]

Thanks for the indepth review.

[dinosaur07]

Definitely a very professional review for a very good software. Pity that the giveaway is not for the forensic version. 
Thanks a lot for the review!

[tarekma7]

Definitely a very professional review for a very good software. Pity that the giveaway is not for the forensic version. 
Thanks a lot for the review!

I tried to have giveaway of the forensic version but...................look at the price!!!!!

[dinosaur07]

Definitely a very professional review for a very good software. Pity that the giveaway is not for the forensic version. 
Thanks a lot for the review!

I tried to have giveaway of the forensic version but...................look at the price!!!!!

I know this software, i`m hunting it for ages.  :rolleyes:
Standard version is very good also although it has limited features but enough for an average user.

[lpe]

Thanks for the nice detailed review Tarek.