Passware Kit Forensic
Click to enlarge
Magnet Forensics

Passware Kit Forensic

Descripción

The complete solution for the discovery and decryption of encrypted electronic evidence.

What's new in version 2025 v4:

  • GPU-accelerated password recovery for the Enpass manager
  • Verification of previously found passwords in other items in batch mode
  • macOS 26 Tahoe support
  • Redesigned license manager
  • Improved performance for Mozilla databases

To view the full list of features and updates, visit passwa.re/pkf.

Live memory analysis
Analyzes active memory images and hibernation files, extracting encryption keys for hard drives, Windows and Mac account logins, and passwords for files and websites, all in a single optimized process.

Password recovery for over 390 file types
MS Office, PDF, Zip and RAR, QuickBooks, FileMaker, Lotus Notes, Apple Notes, Bitcoin wallets, password managers, and many other applications.

Email notifications
Automatically sends an email each time a password is found or when the recovery process completes.

Encryption detection and analysis
Detects all encrypted files and disk images and reports the encryption type and decryption complexity.

Passware Kit multi-platform agents
Supports distributed password recovery with Agents for Windows, Linux, Amazon EC2, and Microsoft Azure. The Resource Manager configures recovery clusters and manages local and remote hardware.

FDE (Full Disk Encryption) decryption
Decrypts or recovers passwords for APFS, Apple DMG, BitLocker, Dell, FileVault2, LUKS, McAfee, PGP, SanDisk, Steganos, Symantec, TrueCrypt, VeraCrypt, containers, disk images, and vaults.

Hardware acceleration
Accelerated password recovery with multiple computers, NVIDIA and AMD GPUs, and Rainbow tables.

Batch processing
Runs password recovery for groups of files and FDE images without user intervention. Allows quickly transferring the recovery process to another computer using digests instead of large files or disk images. Automatic verification of recovered passwords against previous or skipped files from the session.

Automatic updates
Optional automatic software and agent updates, with a one-year subscription to the Software Maintenance and Support (SMS) service. The first year of SMS is included.

Passware Bootable Memory Imager
A UEFI-compatible tool that captures memory images from Windows, Linux, and Mac computers. Passware Memory Imager works on Windows machines with Secure Boot enabled.

Online training: Passware Certified Examiner (PCE)
Designed specifically for digital forensic professionals, this self-paced course offers top-tier knowledge and skills to analyze and decrypt encrypted electronic evidence, in an easy-to-follow format.
During the course, students learn to detect encrypted evidence, recover passwords from the most common file types, analyze memory images, recover passwords from mobile backups, decrypt hard drives, and more.
Sign up at passware.com/training.

Network distributed password recovery: Passware Kit Agent
Passware Kit Agent is a network-distributed password recovery system for Passware Kit Forensic.
Runs on Windows and Linux (32 and 64 bit) and offers linear performance scalability.
Each computer running Passware Kit Agent supports multiple CPUs and GPUs simultaneously.
Users can remotely control all Agents within their network directly from Passware Kit Forensic.
The software includes 5 agents, with the option to acquire more as needed.
Learn more at passware.com/distributed.

Compatible with:

  • Azure Agents
  • Amazon Agents
  • Windows Agents
  • Linux Agents

Optional device decryption add-on
The Passware Kit Device Decryption Add-on is an advanced forensic tool that allows you to unlock, decrypt, and recover passwords or recovery keys from:

  • Western Digital My Passport drives (2014–2024) and My Book (2021–2024, 4TB/6TB)
  • Transcend, Seagate, and LaCie drives
  • Lenovo ThinkPad laptops
  • BitLocker-encrypted devices with TPM and PXE
  • Macs with Apple T2 security chips

The add-on is available to law enforcement, government agencies, and private companies with justified needs, such as forensic firms or corporate investigation teams.
All requests are subject to manual verification.

Hardware acceleration and resource management
Passware Kit Forensic can increase password recovery speed up to 1,200 times using a single GPU.
The Mac version supports OpenCL acceleration with AMD GPUs and NVIDIA/AMD eGPUs.
It allows distributing recovery tasks across a network of Windows or Linux computers, as well as on Amazon EC2 and Microsoft Azure, achieving linear scalability.
The built-in Resource Manager facilitates the configuration of the password recovery cluster.
An intelligent resource allocation algorithm for concurrent file processing minimizes hardware downtime.