Apple takes privacy, security, and encryption very seriously. While the latest improvements in macOS and iOS security help users to keep their data safe, they also create additional challenges for forensic examiners.
All the latest Apple computers are protected with the Apple T2 Chip that provides an additional layer of hardware-based encryption, making it difficult to access APFS disks in a forensically sound way.
We are excited to announce extended support for macOS with the release of a beta version of Passware Kit Forensic for Mac.
The new Passware Kit 2020 version 2:
- unlocks APFS disks from Mac computers with Apple T2 chip;
- extracts passwords from the macOS system keychain;
- decrypts QuickBooks 2020 databases;
- improves GPU acceleration for Bitcoin and Zip archives.
What’s New
Access to APFS disks from Mac computers with Apple T2 Chip
Passware Kit Forensic features a new built-in tool that unlocks APFS disks from Mac computers protected with T2 chip if the iCloud recovery option was enabled.
The tool requires either iCloud credentials or iOS backup of the same Apple ID.
Passware Kit Forensic runs from a Mac connected to the target computer via thunderbolt/USB-C, unlocks the APFS disk via iCloud recovery, and mounts it to the customer’s Mac in a read-only mode.
Passware Kit Forensic for Mac
Passware introduces a beta version of Passware Kit Forensic for Mac, which supports the key features of a Windows version: file password recovery, FDE decryption, mobile forensics, batch file processing, distributed password recovery, etc.
In addition to this, Passware Kit Forensic for Mac provides access to APFS disks from Mac computers with an Apple T2 chip.
This Beta version is available for free to all Passware Kit Forensic customers with an active SMS subscription.
Passwords extraction from macOS system keychains
In addition to passwords extraction from macOS keychain, Passware Kit 2020 v2 also instantly extracts passwords from the macOS system keychain.
This file named system.keychain stores Wi-Fi passwords, certifications, and private keys. The system keychain decryption requires a master key file.
Instant decryption and password recovery for QuickBooks 2020 databases
Passware Kit instantly decrypts databases created with QuickBooks 2020. A password recovery option is also available.
Support for Windows account selection for PIN / password recovery
The “Standalone System Analysis” option now analyzes both system folders: “Config” and “Users,” and allows to select a single Windows user to recover its password. Passware Kit now also displays users with no password set or with an empty password.
After a Windows user password or PIN gets recovered, Passware Kit extracts websites, email, and other passwords stored in the registry for this user.
Recovery of Windows accounts’ passwords from SAM databases in batch mode
Passware Kit now analyzes SAM databases from different systems in batch mode and recovers passwords for Windows users.
Improved GPU performance
We have increased GPU acceleration performance up to 3 times for Zip AES, and 1.5 times for Bitcoin.
A single Decryptum unit now checks over 27,000,000 passwords for Zip AES archives per second.
UI improvements for displaying recovered passwords
For files protected with multiple passwords, Passware Kit now shows the results immediately after the recovery of any password while keeping the recovery process for other passwords running.
In case of a hard disk password recovery, Passware Kit displays all the passwords recovered immediately, rather than waiting for the MD5 calculation to complete.
Passware Kit Business and Passware Kit Forensic
customers only
Decryptum™ Password Recovery
In partnership with Comino we have developed Decryptum – ultra-compact liquid-cooled GPU accelerated devices for password recovery and decryption.
Decryptum PR 2080TI-S/12 4U is the ultimate scalable turnkey decryption solution: a single 4-unit system is powered by 12 x 2080TI GPUs and delivers unparalleled performance.
| Encryption | Passwords / second |
|---|---|
| MS Office 2013+ | 285,000 |
| macOS / FileVault2 / APFS | 210,554 |
| RAR 5 | 1,205,000 |
| Apple iTunes Backup / iOS 10.x+ | 4,000 |
| MS Windows / BitLocker | 40,000 |