How-to guides and tutorials

With PDFs being widely used across industries and everyday tasks, what happens when access is lost? This article explains PDF encryption and the techniques used for password recovery and document unlocking.

To stay current and make the most of Passware Kit’s latest features, take a look at some of the articles we have added or revised over the past year.

Handling encrypted items in a forensic case, especially with Full Disk Encryption (FDE) images and archives, requires significant computational resources. This task is impossible without relying on network-distributed, hardware-accelerated decryption.

This article provides comprehensive insights into Apple native encryption, covering both software and hardware-based levels.

A password manager app, besides passwords, can contain additional data sources, emails, connections, online banking details, and even documents. This data is very appealing to computer forensics. Let’s take a closer look into the password managers, their versions, and how difficult it is to break into them.

When it comes to the forensic investigation of Apple devices, a Keychain analysis is of particular importance. Not only does Keychain contain passwords from websites and applications, but it can also provide computer forensics with access to the same user’s other Apple devices.

Did you know that we upload technical articles and useful tips to our Knowledge Base on a regular basis? For the last 12 months, we have added a dozen new articles to the database.

No one can imagine an effective password recovery process without GPU acceleration. The race between AMD and NVIDIA GPU rages on, so the question “Which is best for password recovery?” arises with every single release of a new GPU generation.

Memory analysis is an essential part of digital forensic investigations. A memory image can contain passwords and encryption keys that allow computer forensics to access encrypted hard drives, files, emails, and other electronic evidence. However, to preserve this data in the memory image, it’s required to use forensically sound memory acquisition practices.

An examiner can use a set of external registry hives and user profile files acquired from the target computer or its disk image for password recovery and electronic evidence discovery.

VeraCrypt and former TrueCrypt are two of the most challenging types of encryption to bypass with regard to their popularity as full disk encryption software.