Passware Kit User Guide

Transcription

1 Passware Kit User Guide

2 Overview of the Passware Kit You can use the Passware Kit to recover lost file, , and Internet passwords, as well as search for password-protected files. What do you want to do? Learn more about the Passware Kit Quick Start

3 Quick Start Recovering a lost password is easy with the Passware Kit. Simply follow these basic steps: 1. Launch the Passware Kit application. 2. Click the link on the Start Page that relates to the type of password you want to recover (file, and network, or Windows Administrator). 3. Follow the instructions on the screen -- for some types of passwords, such as file passwords, you have to fill out a few fields; for other types, such as Outlook Express account passwords, the password recovery process starts immediately. 4. When the password recovery process is complete, the results are displayed in the window. 5. You can then save and print the results. NOTE: At any time when using Passware Recovery Kit, you can click the Start Page button at the top of the screen to cancel out of what you are doing and start over. What do you want to do? Recover a lost file password Recover a lost , Internet, or network password Reset your Windows Admin password

4 Search for password-protected files Recover a lost password for encrypted hard drive Recover lost passwords for a standalone computer (registry analysis) Recover passwords from Windows/Unix/Mac hash files Work with Passware Kit Portable Use Passware Kit Forensic with EnCase Test password recovery settings

5 Getting Around in the Passware Kit Application Navigating in the Passware Kit application is as simple as a few mouse clicks.

6 Important Buttons Here are a few of the most commonly used buttons. Takes you to the Start Page (the page that appears when you launch the application). Starts the currently selected action, such as a password attack or search for protected file. Takes you to the previously displayed page, just as in an Internet browser. Takes you to the next page in your browsing sequence. Opens this Help file.

7 Window Arrangement The main application window is divided into two main parts. The left pane lists available actions (these vary, depending on what you are doing), and details about the currently viewed action, if there are any. The wider, right pane is where you select choices, enter values, and view password recovery and protected file search results. At the bottom of the window is a status bar that may contain hints on how to proceed.

8 Working with Passware Kit You can use the Passware Kit to recover lost passwords, wherever they are -- file passwords, account passwords, Internet passwords, and VPN and network passwords. What do you want to do? Recover a lost file password Recover a lost , Internet, or network password Reset your Windows Admin password Search for password-protected files Recover a lost password for encrypted hard drive Recover lost passwords for a standalone computer (registry analysis) Recover passwords from Windows/Unix/Mac hash files Work with Passware Kit Portable Work with Decryptum Portable Use Passware Kit Forensic with EnCase Test password recovery settings

9 Recovering File Passwords Not being able to open or use a file because you can't remember its password can be frustrating. The Passware Kit can help you recover passwords for many types of files. The quickest way to start password recovery for a file is to click the Recover button on the Start Page, or press Ctrl+O. Once the Passware Kit discovers the password for a file, it remembers that password. If you ever forget the same password, you don't have to run all the attacks again - simply select the file, and the Passware Kit displays the password immediately. If one or more passwords in the original file were reset (changed) or removed (for example, QuickBooks QBW passwords to open or MS Excel Workbook and Worksheet passwords), the Passware Kit creates an unprotected file that is listed in the results of the password recovery process. If the Passware Kit recovers all original passwords, it doesnt create the unprotected file (for example, MS Excel passwords to open and MS Access passwords). What do you want to do? Use the Password Recovery Wizard - best for users who know something about their passwords, but are new to password recovery. Run the default attacks - best for users who know nothing about their passwords. Use the Attack Editor - best for advanced users and who are decrypting strong passwords. Learn about reports and log files

10 Using the Attack Wizard The Attack Wizard walks you through setting up your search for a lost file password, step-by-step. The Attack Wizard is best for situations where you know something about the password, but are new to password recovery. When you complete the Wizard, Passware Kit automatically sets up the proper password recovery attacks, based on your answers.

11 Starting the Attack Wizard 1. Launch the Passware Kit application. 2. Click Recover File Password (or press Ctrl+O). This displays the Open dialog box. 3. Choose the file for which you want to find the password, and click Open. This displays the screen shown below: 4. Click Run Attack Wizard (or press Ctrl+W).

12 Filling Out the Attack Wizard Information The Attack Wizard consists of several screens, asking you to supply as much information about your password as possible. NOTE: At any point in the Attack Wizard, you can click the Skip and Start button to simply start recovering your password - but bear in mind that the recovery process may take longer, or be less successful, than if you had completed the wizard. Specifying the General Password Format The first Attack Wizard screen, shown below, asks you to supply the general format of the password. For example, does it consist of one dictionary word, or more than one? Choose the best selection and click Next. NOTE: If you choose I know nothing about my password, there are no "Next" screens - simply click Finish to start the password recovery process with the default settings. From this point forward, the Attack Wizard screens differ, depending on which general format you choose. Single Dictionary Word Multiple Dictionary Words One or More Dictionary Words Combined with Letters, Numbers, or

13 Symbols Non-dictionary, but Similar to a Dictionary Word Other

14 Running the Default Attacks If you do not know anything about a missing password, you can simply run the default attacks to find the password.

15 Starting the Default Attacks 1. Launch the Passware Kit application. 2. Click Recover File Password (or press Ctrl+O). This displays the Open dialog box. 3. Choose the file for which you want to find the password, and click Open. This displays the screen shown below: 4. Click Use Pre-defined Default Attacks (or press Ctrl+D). The attacks start immediately, and when finished, the results appear in the window.

16 Which Attacks Are Run The following list describes the default attacks, in the order in which they are run, and gives examples of the sort of password each attack is best at finding, where appropriate. 1. Previous Passwords Attack (with modifiers Original Password, Normal Casing, Upper Casing, and Lower Casing) 2. Decryptum Attack (if applicable) - free demo preview of decrypted Word or Excel file 3. SureZip Attack (if applicable) - instant decryption of Zip archives up to version Brute-force Attack (English, 1-4 characters, full symbol set: lowercase letters, uppercase letters, numbers, symbols, space) Sample password: "Pw5@" 5. Dictionary Attack (English words up to 15 letters, with all possible Casing modifiers) Sample password: "Specialization" 6. Xieve Attack (passwords similar to English words, from 5 to 9 letters, lowercase, level "Medium" - checks common combinations of letters only) Sample password: "mycomp" 7. Brute-force Attack (Numbers only, from 5 to 8 characters) Sample password: " " 8. Join Attacks group: 1. Dictionary Attack (English words from 1 to 9 letters) + 2. Append Attacks group: 1. Brute-force Attack (from 1 to 2 characters, symbols+numbers) 2. Brute-force Attack (from 3 to 4 characters, numbers only) Sample password: "open123" 9. Join Attacks group: 1. Dictionary Attack (English words from 1 to 9 letters) + 2. Dictionary Attack (English words from 1 to 9 letters) Sample password: "greenapple" 10. Brute-force Attack (English, from 5 to 7 characters, lowercase letters +

17 numbers) Sample password: "qw3erty" 11. Xieve Attack (passwords similar to English words, from 10 to 11 letters, lowercase, level "Low" - checks almost all combinations of letters) Sample password: "sweetemily"

18 Using the Attack Editor The Attack Editor allows you great control over the password recovery process. You can choose which attacks you want to use, modify attack settings, and combine attacks. The Attack Editor is best used if you are an experienced IT person who knows a lot about password recovery.

19 Starting the Attack Editor 1. Launch the Passware Kit application. 2. Click Recover File Password (or press Ctrl+O). This displays the Open dialog box. 3. Choose the file for which you want to find the password, and click Open. This displays the screen shown below: 4. Click Use Attack Editor (or press Ctrl+E). The Attack Editor appears, a sample of which is shown in the following figure.

20 The Attack Editor window is divided into three parts. On the left, you see available actions and details. In the middle are the attacks which will be run, and on the right is an "attack tree" which lists available attacks and attack modifiers. Once you have the attacks the way you want them, start the attacks by clicking the Start button at the top of the window clicking the Start Recovery button in the bottom right corner of the Attack Editor window clicking on the Start Recovery selection in the Actions area of the left pane. What do you want to do? Add an attack Remove an attack Rearrange Attacks Use Attack Modifiers Reset attack settings to their default values Save or load attacks Sort attacks according to duration

21 Reports and Log Files The Passware Kit provides several reports and log files that track its activity during a password recovery operation. You can print and save these files for future reference.

22 Passwords Found Report Once an attack is complete, the Passware Kit displays the results of the password recovery process in the Passwords Found Report, a sample of which is shown below: In the report, you'll see any recovered passwords. Click on a "copy" link to copy a password to the Windows Clipboard. For files with instant unprotection, you can click on a filename to open a protected or unprotected file

23 Attacks Report The Passware Kit also reports which attacks it used, how long they took, their state (such as started, successful, or unsuccessful), and what passwords were recovered by which attacks. To view this report, click the Attacks tab at the bottom of the window. A sample Attacks Report is shown below:

24 Log A third type of information provided by the Passware Kit is a log that tracks each attack's start and stop time, and other useful information. To view the log, click the Log tab at the bottom of the window. A sample Log is shown below: What do you want to do? Print a report or log Save a report or log

25 Recovering Passwords for Multiple Files Passware Kit supports batch file processing, recovering passwords for multiple files, one-by-one, in an automated way.

26 How to Start Select multiple files for decryption using the Recover File Password option at the Start Page. You can also initiate password recovery for multiple files from the results of the Search for Protected Files option. Select the files that you want to decrypt from the list of encrypted files displayed by Passware Kit. Then click the Recover button as shown below:

27 Groups and Settings Once you have selected the files to decrypt, Passware Kit groups them according to the decryption options, i.e., Known Password, Instant, Default. You can add, modify, or delete groups. For each group (except for Known Password and Instant groups, for which the password is recovered instantly regardless of its settings) you can use the Predefined settings, or customize them in Attack Editor. Click the Save Settings and Return button to save the changes and return to the list of files.

28 Recovering the Passwords Once you have set up the list of files and password recovery attacks, click the Recover button to start the batch password recovery process: While the password recovery is in progress, you can pause, resume, or stop it, as well as skip attacks, files, or groups. As a result, Passware Kit displays the passwords recovered, as well as a log file. A sample result is shown below:

29 You can enable the option to create unprotected files automatically when a password is recovered or reset at Tools Options Folders. When batch file processing is complete, unprotected copies of the files will be saved in a single folder. Supported file types: MS Office, Zip, FileMaker, SQL, MYOB, and QuickBooks.

30 Searching for Protected Files Using an Explorer-like interface and clicking a few checkboxes and buttons, you can find your password-protected files quickly and easily. Encrypted volumes and hard disk images, such as BitLocker, TrueCrypt, PGP, etc., are also detected. What do you want to do? Select the files to scan Monitor scan progress Work with scan results Start a new scan

31 Searching for Protected Files - Quick Start To find password-protected files on your computer system: 1. Click Search for Protected Files on the Passware Kit start page: You will see the following screen: 2. Click the Start Scan button in the bottom-right corner of the window. This scans your entire computer system for password-protected files. A dialog box appears to indicate the scan is complete:

32 Click OK to close this dialog box. After the scan is complete, you can Save the list Save the scan log Recover passwords Start a new scan

33 Selecting the Files to Scan You can scan specific files -- from your entire computer system to one or two selected folders. You can also select the type of scan you want to use. A full scan includes scanning system folders, slow file types, encrypted containers and disk images, and calculating MD5 values. You can disable these options if you need a less complete, but much faster scan. What do you want to do? Choose scan type Choose what to scan After you have chosen the type of scan and the folders and/or drives to scan, start the scan by clicking the Start button on the toolbar, which looks like this:

34 Scan Options The software offers four options of the scan. Which one you use depends on what type of password-protected file you are looking for, and how fast you want the scan to run. Scan Option Scan system folders Scan slow file types Scan for encrypted containers and disk images Calculate MD5 When to Use System folders and registry files are unlikely to contain any encrypted items. It is appropriate to use this option only if you need the full system scan. Some file types, such as MS SQL and ACT! databases, or any unknown types of files, are slow to analyze. Disable this option to make the scan faster, or enable it if you need the complete scan of the file system. Use this option if you assume that your system has TrueCrypt containers and other disk images. There might be false positives with this option. Use this option if you need your reports completed with MD5 hash values for each encrypted file detected. Otherwise, disable it as it slows down the scan speed. Enable or disable these options in the Scan Options area of the window, shown below:

35 Next, you can choose what to scan. NOTE: The settings you choose in the Scan Options area are saved when you exit the application, and are in effect the next time you launch the program.

36 Monitoring Scan Progress You can track the progress of the scan in several ways: The Scan Progress area at the top of the main window displays a graphical progress bar, and lists time elapsed and time-to-completion. A sample Scan Progress area is shown here: The Status Bar, visible along the bottom of the window, gives a summary of the number of protected items found and the total number of items scanned. The Scan Status area summarized the scan status. A sample is shown here: NOTE: If you want, you can turn off the Status Bar. You can temporarily pause or cancel a scan at any time.

37 Canceling or Pausing a Scan You can temporarily pause a scan at any time by clicking the Pause button in the toolbar: To resume a paused scan, click the Resume button in the toolbar: You can cancel a scan at any time by clicking the Stop button in the toolbar:

38 Working with the Scan Results After scanning the selected folders, the application displays a both a list of password-protected files (in the right pane of the window) and a summary of the scan results (in the Last Scan area on the left side of the window). An sample scan result is shown below: NOTE: Clicking on the Items Skipped line in the Last Scan area displays the scan log. What do you want to do? Work with selected files from the scan results Customize the appearance of the scan results Save the file list Save the scan log

39 Recovering File Passwords Once you have found one or more password-protected files, you can recover the password using the Passware Kit.

40 Start a New Scan When you click Search for Protected Files on the Start Page, the window defaults to the new scan display. To start a new scan after another scan has already completed: 1. Click Start a New Scan in the Actions area of the window. 2. A dialog box, shown below, appears, asking if you want to start a new scan. 3. Click Yes. to start a new scan. Another way to start a new Scan is to click the Back button on the toolbar. CAUTION: The results of the previous scan are cleared from the screen when you click Yes. If you want to save the results for future use, be sure to save the file list before starting a new scan.

41 Analyzing Memory and Decrypting Hard Disks You can use the Passware Kit to decrypt hard disks encrypted with BitLocker, TrueCrypt or FileVault 2. BitLocker is a data protection feature available in Windows systems starting from Vista. TrueCrypt is a software application that creates virtual hard disks with real-time encryption. FileVault 2 is a system which encrypts files on a Macintosh computer. It can be found in the Mac OS X Lion operating systems. To get started, display the Passware Kit Start Page, and click Analyze Memory and Decrypt Hard Disk (or press Ctrl+D). This displays the following window: What do you want to do? Recover BitLocker encryption keys Decrypt a TrueCrypt volume Decrypt a FileVault volume

42 Recovering BitLocker Encryption Keys Passware Kit recovers encryption keys for hard drives encrypted with BitLocker. BitLocker is a data protection feature available in Windows Vista and Windows 7. The software scans the physical memory image file (created while the encrypted disk was mounted) and extracts all the encryption keys for a given volume. To recover BitLocker encryption keys, two images of the target system are required: The image file of the encrypted volume. The physical memory image file or hiberfil.sys file from the target system (with the encrypted volume mounted). Disk volume images can be created using third-party tools, such as Guidance EnCase, Free EASIS Drive Cloning, or DD. Physical memory images can be created using Passware FireWire Memory Imager or third-party tools, such as ManTech Physical Memory Dump Utility or win32dd. If the target computer with the BitLocker volume is powered off, encryption keys are not stored in its memory, but they could be possibly recovered from the hiberfil.sys file, which is automatically created when a system hibernates. NOTE: If the target computer is turned off and the BitLocker volume was dismounted during the last hibernation, neither the memory image nor the hiberfil.sys file will contain the encryption keys. Therefore, instant decryption of the volume is impossible. In this case, Passware Kit assigns Brute-force attacks to recover the original password for the volume. Once the images are created, follow these steps to recover the password: 1. Click Analyzing Memory and Decrypting Hard Disk (or press Ctrl+D) on the Passware Kit Start Page. This displays the screen shown below:

43 2. Click BitLocker (or press Ctrl+B). This displays the screen shown below: 3. Click Browse and locate the image file of the BitLocker encrypted volume or partition. 4. Click Browse and locate the physical memory image (memory.bin) or the hiberfil.sys file from the computer to which your encrypted volume was mounted. If you do not have this memory image and the target computer is still powered on, click Acquire a memory image and follow the on-

44 screen instructions. NOTE: If the target computer is turned off and the BitLocker volume was dismounted during the last hibernation, neither the memory image nor the hiberfil.sys file will contain the encryption keys. Therefore, instant decryption of the volume is impossible. In this case, switch to The BitLocker volume is dismounted option, and Passware Kit will assign Brute-force attacks to recover the password for the volume. 5. Click Next. This procedure initiates the encryption key recovery process. The recovery might take several minutes depending on the size of the memory image file. The results are displayed when the recovery is complete. The figure below shows a sample result.

45 Decrypting a TrueCrypt Volume Passware Kit decrypts hard disk volumes encrypted with TrueCrypt. TrueCrypt is a software application that creates virtual hard disks with real-time encryption. The software scans the physical memory image file (created while the encrypted disk was mounted), extracts all the encryption keys, decrypts the given volume, and saves the image of the decrypted volume. To decrypt a TrueCrypt volume, the physical memory image file or hiberfil.sys file from the target system (with the encrypted volume mounted) is required. The Passware Kit can work with either a TrueCrypt volume file (encrypted file container), or with its image. Disk volume images can be created using third-party tools, such as Guidance EnCase, Free EASIS Drive Cloning, or DD. Physical memory images can be created using Passware FireWire Memory Imager or third-party tools, such as ManTech Physical Memory Dump Utility or win32dd. If the target computer with the TrueCrypt volume is powered off, encryption keys are not stored in its memory, but they could be possibly recovered from the hiberfil.sys file, which is automatically created when a system hibernates. NOTE: If the target computer is turned off and the TrueCrypt volume was dismounted during the last hibernation, neither the memory image nor the hiberfil.sys file will contain the encryption keys. Therefore, instant decryption of the volume is impossible. In this case, Passware Kit assigns Brute-force attacks to recover the original password for the volume. Once the images are created, follow these steps to recover the password: 1. Click Analyzing Memory and Decrypting Hard Disk (or press Ctrl+D) on the Passware Kit Start Page. This displays the screen shown below:

46 2. Click TrueCrypt (or press Ctrl+T). This displays the screen shown below: 3. Click Browse and locate the TrueCrypt volume file or its image file. 4. Click Browse and locate the physical memory image (memory.bin) or the hiberfil.sys file from the computer to which your encrypted volume was mounted. If you do not have this memory image and the target computer is still powered on, click Acquire a memory image and follow the onscreen instructions.

47 NOTE: If the target computer is turned off and the TrueCrypt volume was dismounted during the last hibernation, neither the memory image nor the hiberfil.sys file will contain the encryption keys. Therefore, instant decryption of the volume is impossible. In this case, switch to The TrueCrypt volume is dismounted option, and Passware Kit will assign Brute-force attacks to recover the password for the volume. 5. Click Browse and select the location and name of the destination file (the image of the decrypted volume). 6. Click Next. This procedure initiates the decryption process. The decryption might take several minutes depending on the size of the memory image file. The results are displayed when the decryption is complete. The figure below shows a sample result.

48 Decrypting a PGP WDE Volume Passware Kit decrypts hard disk volumes encrypted with PGP Whole Disk Encryption. The software scans the physical memory image file (created while the encrypted disk was mounted), extracts all the encryption keys, decrypts the given volume, and saves the image of the decrypted volume. To decrypt a PGP volume, the physical memory image file or hiberfil.sys file from the target system (with the encrypted volume mounted) is required. PGP volume images can be created using third-party tools, such as Guidance EnCase, Free EASIS Drive Cloning, or DD. Physical memory images can be created using Passware FireWire Memory Imager or third-party tools, such as ManTech Physical Memory Dump Utility or win32dd. If the target computer with the PGP volume is powered off, encryption keys are not stored in its memory, but they could be possibly recovered from the hiberfil.sys file, which is automatically created when a system hibernates. NOTE: If the target computer is turned off and the PGP volume was dismounted during the last hibernation, neither the memory image nor the hiberfil.sys file will contain the encryption keys. Therefore, instant decryption of the volume is impossible. In this case, Passware Kit assigns brute-force attacks to recover the original password for the volume. Once the images are created, follow these steps to recover the password: 1. Click Analyze Memory and Decrypt Hard Disk (or press Ctrl+D) on the Passware Kit Start Page. This displays the screen shown below:

49 2. Click PGP WDE (or press Ctrl+P). This displays the screen shown below: 3. Click Browse and locate the encrypted PGP volume image file. 4. Click Browse and locate the physical memory image (memory.bin) or the hiberfil.sys file from the computer to which your encrypted volume was

50 mounted. If you do not have this memory image and the target computer is still powered on, click Acquire a memory image and follow the onscreen instructions. NOTE: If the target computer is turned off and the PGP volume was dismounted during the last hibernation, neither the memory image nor the hiberfil.sys file will contain the encryption keys. Therefore, instant decryption of the volume is impossible. In this case, switch to The PGP disk is dismounted option, and Passware Kit will assign brute-force attacks to recover the password for the volume. 5. Click Browse and select the location and name of the destination folder (the folder to save decrypted volume to). 6. Click Next. This procedure initiates the decryption process. The decryption might take several minutes depending on the size of the memory image file. The results are displayed when the decryption is complete. The figure below shows a sample result.

51 Recovering Mac Passwords You can use Passware Kit to recover the following passwords for Mac OS: user login passwords and keychain file passwords. What do you want to do? Decrypt a FileVault2 volume Recover login passwords for Mac OS Recover a password for a Mac keychain file

52 Decrypting a Mac FileVault2 Volume Passware Kit recovers encryption keys for hard drives encrypted with FileVault2. FileVault2 is a data protection feature available in MAC OS X starting from v The software scans the physical memory image file (created when the encrypted disk was mounted), extracts all the encryption keys, decrypts the given volume, and saves an image of the decrypted volume. To recover FileVault2 encryption keys, two images of the target system are required: the image file of the encrypted volume the physical memory image file from the target system (with the encrypted volume mounted and at least one user logged in) Disk-volume images can be created using third-party tools such as Guidance EnCase, Free EASIS Drive Cloning, DD, and Apple Disk Utility. Physicalmemory images can be created using Passware FireWire Memory Imager. NOTE: If the target computer is turned off, the memory image will not contain the encryption keys. Therefore, instant decryption of the volume is impossible. In this case, Passware Kit assigns brute-force attacks to recover the original password for the volume. Once the images are created, follow these steps to recover the encryption key: 1. Click Analyze Memory and Decrypt Hard Disk on the Passware Kit Start Page. This displays the screen shown below:

53 2. Click FileVault. This displays the screen shown below: 3. Click Browse... and locate the image of the FileVault2 encrypted volume or partition. 4. Click Browse... and locate the physical memory image (memory.bin) file from the computer in which your encrypted volume was mounted. If you

54 do not have this memory image and the target computer is still powered on, click Acquire a memory image and follow the on-screen instructions. NOTE: If the target computer is turned off, the memory image will not contain the encryption keys. Therefore, instant decryption of the volume is impossible. In this case, switch to the FileVault volume is dismounted option, and Passware Kit will assign regular brute-force attacks to recover the password for the volume. 5. Click Browse... and select the location and name of the destination file (the image of the decrypted volume). 6. Click Next. This procedure initiates the decryption process. The decryption might take several minutes depending on the size of the memory image file. The results are displayed when the decryption is complete. The figure below shows a sample result.

55 Recovering a Mac FileVault2 Password If the instant decryption option through memory analysis is not applicable, e.g., if the target computer is turned off or the memory image does not contain the encryption keys for some reason, Passware Kit can still recover the original password for the FileVault disk. To recover the password, Passware Kit requires a FileVault Wipekey file. To access and copy this file from the target computer, follow the steps below, depending on whether you have direct access to the target computer or just the hard disk image. If you have access to the target computer: 1. Boot the target Mac computer with a Setup/Recovery CD; 2. Launch the Terminal tool from the Setup CD; 3. Type command: defaults write com.apple.diskutility DUDebugMenuEnabled 1; 4. Open the tool Disk Utility; 5. In the Debug menu, choose Show every partition, then choose Recovery HD and click Mount; 6. Locate the Wipekey file (normally named EncryptedRoot.plist.wipekey) at: com.apple.boot.r/system/library/caches/com.apple.corestorage/ NOTE: The directory name can also be com.apple.boot.s or com.apple.boot.p; 7. Copy the EncryptedRoot.plist.wipekey file to the computer on which you run Passware Kit. If you have the target disk image: Mount it with any disk-mounting tool and proceed to step 7. Steps 1-6 refer to mounting the disk image using Guidance EnCase. 1. Run Guidance EnCase; 2. Click New Case and choose the name and location of the case file; 3. Click Add Evidence;

56 4. Click Add Local Device, then click Next; 5. Pick up the device with the label Apple and click Finish; 6. In the Table window, double-click the target disk; 7. In the Evidence tab, locate the Recovery HD partition; 8. Locate the Wipekey file (normally named EncryptedRoot.plist.wipekey) at: com.apple.boot.r/system/library/caches/com.apple.corestorage/ NOTE: The directory name can also be com.apple.boot.s or com.apple.boot.p; 9. Copy the EncryptedRoot.plist.wipekey file to the computer on which you run Passware Kit. Once you have copied the Wipekey file to your computer, run Passware Kit and follow these steps to recover the password: 1. Click Analyze Memory and Decrypt Hard Disk on the Passware Kit Start Page. This displays the screen shown below: 2. Click FileVault. This displays the screen shown below:

57 2. Click FileVault. This displays the screen shown below: 3. Click Browse... and locate the image of the FileVault2 encrypted volume or partition; 4. Click the FileVault volume is dismounted option; 5. Click Browse... and select the location of the Wipekey file as shown below: 6. Click Next.

58 This procedure initiates the decryption process. It might be accelerated using NVIDIA and AMD GPU cards, as well as Distributed Password Recovery. The results are displayed when the decryption is complete. The figure below shows a sample result.

59 Recovering Mac Login Passwords You can use Passware Kit to recover login passwords for Mac OS users in a matter of minutes, regardless of the password length and use of a FileVault encryption. The following operating systems are supported: Mac OS X Version 10.5 (Leopard), 10.6 (Snow Leopard), 10.7 (Lion) The software scans the physical memory image file (acquired while the target system is running and at least one user remains logged in, even if the user is currently logged out or the account is locked) and extracts all the login passwords for a given system. Physical memory images can be created using Passware FireWire Memory Imager. If the target Mac computer is powered off, login passwords are not stored in its memory, and therefore it is impossible to recover them. To get started, display the Passware Kit Start Page, and click Analyze Memory and Decrypt Hard Disk Mac User (or press Ctrl+M). This displays the following window: Locate the physical memory image (memory.bin) of the target Mac computer.

60 If you do not have this memory image, follow these steps to acquire it using Passware Kit: 1. At the Passware Kit Start Page click Analyzing Memory and Decrypting Hard Disk. 2. Click Passware FireWire Memory Imager. 3. Follow the on-screen instructions. Once the image is created, follow these steps to recover the password: 1. Click Recover Mac Password (or press Ctrl+M) on the Passware Kit Start Page. 2. Locate the physical memory image (memory.bin) from the target computer and click Open. This procedure initiates the password recovery process, as shown below: The recovery might take several minutes depending on the size of the memory image file. The results are displayed when the recovery is complete. The figure below shows a sample result.

61

62 Recovering Mac Keychain Passwords You can use Passware Kit to recover passwords for Mac OS keychain files. Files from the following operating systems are supported: Mac OS X Version 10.5 (Leopard), 10.6 (Snow Leopard), 10.7 (Lion) Mac keychain files are usually stored at /Users//Library/Keychains and are protected with a password. By default, the keychain password is the same as the corresponding Mac user login password, but it may also be different. By recovering this password, you gain access to the following user information contained in the keychain file: saved passwords (for websites, network shares, wireless networks), private keys, certificates, etc. NOTE: Passware Kit does not support System.keychain files. To get started, display the Passware Kit Start Page, then click the Recover button, or press Ctrl+O. Locate the keychain file (by default this file is named login.keychain) and click Open. This displays the following window: Choose one of the following options for password recovery, depending on the available information about the password:

63 Use the Password Recovery Wizard - best for users who know something about their passwords, but are new to password recovery. Run the default attacks - best for users who know nothing about their passwords. Use the Attack Editor - best for advanced users and who are decrypting strong passwords. This procedure initiates the password recovery process. The results are displayed when the recovery is complete. The figure below shows a sample result.

64 Recovering Windows Login Passwords You can use Passware Kit to recover login passwords for Windows users in a matter of minutes, regardless of the password length and use of a BitLocker encryption. The solution works on all versions of Windows, including Windows 8. The software scans the physical memory image file (acquired while the target system is running, even if the user is currently logged out or the account is locked) and extracts all the login passwords for a given system. Physical memory images can be created using Passware FireWire Memory Imager. If the target computer is powered off, encryption keys are not stored in its memory, but they could be possibly recovered from the hiberfil.sys file, which is automatically created when a system hibernates. In other cases, it is impossible to recover the user passwords instantly. To get started, display the Passware Kit Start Page, and click Analyze Memory and Decrypt Hard Disk Windows User (or press Ctrl+W). This displays the following window: Locate the physical memory image (memory.bin) or the hibernation file

65 (hiberfil.sys) of the target Windows computer. If you do not have this memory image, follow these steps to acquire it using Passware Kit: 1. At the Passware Kit Start Page click Analyzing Memory and Decrypting Hard Disk. 2. Click Passware FireWire Memory Imager. 3. Follow the on-screen instructions. Once the image is created, follow these steps to recover the password: 1. Click Analyze Memory and Decrypt Hard Disk Windows User (or press Ctrl+W) on the Passware Kit Start Page. 2. Locate the physical memory image (memory.bin) or the hibernation file (hiberfil.sys) from the target computer and click Open. This procedure initiates the password recovery process, as shown below: The recovery might take several minutes depending on the size of the memory image file. The results are displayed when the recovery is complete. The figure below shows a sample result.

66

67 Recovering Website Passwords from Memory You can use Passware Kit to recover passwords for Facebook, Google, and other websites in a matter of minutes, regardless of the password length and whether the password was saved in the browser or not. The software scans the physical memory image file (acquired while the target system is running, even if the user is currently logged out or the account is locked) and extracts all the websites' passwords which the user had typed during the last session. Physical memory images can be created using Passware FireWire Memory Imager. If the target computer is powered off, the passwords are not stored in its memory, but they could be possibly recovered from the hiberfil.sys file, which is automatically created when a system hibernates. To get started, display the Passware Kit Start Page, and click Analyze Memory and Decrypt Hard Disk Websites (or press Ctrl+S). This displays the following window: Locate the physical memory image (memory.bin) or the hibernation file (hiberfil.sys) of the target Windows computer. If you do not have this memory

68 image, follow these steps to acquire it using Passware Kit: 1. At the Passware Kit Start Page click Analyzing Memory and Decrypting Hard Disk. 2. Click Passware FireWire Memory Imager. 3. Follow the on-screen instructions. Once the image is created, follow these steps to recover the password: 1. Click Analyze Memory and Decrypt Hard Disk Websites (or press Ctrl+S) on the Passware Kit Start Page. 2. Locate the physical memory image (memory.bin) or the hibernation file (hiberfil.sys) from the target computer and click Open. This procedure initiates the password recovery process, as shown below: The recovery might take several minutes depending on the size of the memory image file. The results are displayed when the recovery is complete. The figure below shows a sample result.

69

70 Passware FireWire Memory Imager To recover BitLocker and TrueCrypt encryption keys, Passware Kit requires a physical memory image file of a target computer that was created while the BitLocker or TrueCrypt encrypted disk was mounted. Passware Kit includes Passware FireWire Memory Imager, which creates a bootable memory-imaging USB drive. This USB drive acquires a memory image of the target computer connected with a FireWire (IEEE 1394) cable. The overall steps on acquiring the memory image with Passware FireWire Memory Imager are: 1. Create a bootable Passware FireWire Memory Imager USB drive 2. Acquire the memory image of the target computer with the USB drive NOTE: If the target computer is powered off, encryption keys are not stored in its memory, but they could be possibly recovered from the hiberfil.sys file, which is automatically created when a system hibernates. If the target computer is powered off and the TrueCrypt/BitLocker volume was dismounted during the last hibernation, neither the memory image nor the hiberfil.sys file will contain the encryption keys. Therefore, instant decryption of the volume is impossible. In this case, Passware Kit assigns Brute-force attacks to recover the original password for the volume.

71 Creating Passware FireWire Memory Imager USB Drive Below are the steps to create a memory-imaging USB drive. 1. On the Start Page click Analyzing Memory and Decrypting Hard Disk (or press Ctrl+D), and then click Passware FireWire Memory Imager. The following screen appears: 1. Insert a USB flash drive and select it in the Select USB drive pulldown menu. Recommended size of the USB flash drive is 8GB and more. 2. Click Next. NOTE: All the files on the USB flash drive will be erased. If you are using Windows Vista, you may need to run Passware Kit as the Administrator in order to create a memory-imaging USB drive. 2. The recording process starts. Passware Kit copies the necessary files on the USB flash drive.

72 3. The bootable Passware FireWire Memory Imager USB drive is now ready. NOTE: Passware FireWire Memory Imager files are created on a hidden partition of the USB flash drive, while the open partition of the drive, which can be viewed in Windows Explorer, is blank. Now that you have created the memory-imaging USB drive, you are ready to acquire the memory image of the target computer.

73 Acquiring Memory Image with Passware FireWire Memory Imager USB Drive Once you have created the bootable Passware FireWire Memory Imager USB drive, you are ready to acquire the memory image of the target computer by following the steps below. Requirements: The target computer is turned on and the encrypted volume is mounted Both the target computer and the computer used for acquisition have FireWire (IEEE 1394) ports A FireWire cable 1. Insert the memory-imaging USB drive and restart your computer. 2. Passware FireWire Memory Imager starts: 3. Make sure the FireWire cable is unplugged and press Next. 4. Connect the target computer with a FireWire cable. If the target computer is not detected after 30 seconds, you may need to unplug and re-connect the FireWire cable.

74 Press Next. 5. The memory imaging process starts: The progress screen displays the time of the imaging process and the size of the acquired target memory. Upon completion of the process, press Next. 6. Unplug the FireWire cable, remove the USB flash drive, and press Reboot to restart your PC. 7. The memory image of the target computer (a memory.bin file) is created

75 on the USB flash drive: Once you have created the memory image of the target computer, you are ready to decrypt BitLocker or TrueCrypt volumes using Passware Kit.

76 Recovering Passwords for Mobile Data You can use the Passware Kit to acquire icloud backups, recover passwords for Apple iphone and ipad backups, Android backups, and Android images. To get started, display the Passware Kit Start Page and click Mobile Forensics. This displays the following window: What do you want to do? Recover a password for Apple itunes or Android backup file Recover a password for an Android device image Acquire an icloud backup

77 Recovering Apple itunes and Android Backup Passwords Apple stores iphone and ipad backups in an itunes backup file (*.PLIST). This file, named Manifest.plist, is normally located in the Apple Computer directory. For example, for Windows 8, the full path is: C:\Documents and Settings\User\AppData\Roaming\Apple Computer\MobileSync\Backup\BackupID\Manifest.plist Android backup files are usually created with an ADB tool from Android SDK and normally have an *.AB extension. Passwords for itunes and Android backup files are recovered using regular password-recovery attacks. The process can be accelerated with GPU cards and distributed computing. To start the password-recovery process, click Mobile Forensics on the Start Page, choose either the iphone Backup or Android Backup option and locate your file. Refer to the Recovering File Passwords section for further recommendations.

78 Recovering Passwords for Android Images Passware Kit recovers passwords for Android physical images acquired from the encrypted devices using third-party tools, such as Oxygen Forensic Passware Analyst. Passwords for Android image files are recovered using regular passwordrecovery attacks. The process can be accelerated with GPU cards and distributed computing. To start the password-recovery process, click Mobile Forensics on the Start Page, choose the Android Image option and locate your file. Refer to the Recovering File Passwords section for further recommendations.

79 Acquiring icloud Backups Passware Kit acquires full ios backups from icloud if Apple ID credentials are known. The backups are downloaded in itunes format (readable by Apple software and Oxygen Forensic Suite Passware Analyst) and plain readable format. All versions of ios, including the latest 8.1, are supported. Below are the steps to acquire an ios backup from icloud. 1. On the Start Page click Mobile Forensics, then choose the icloud Backup option 2. Enter your icloud login. Both Apple ID and password should be entered as shown on the screen below: 3. Click Next. The following screen appears:

80 4. Choose the backup snapshots you want to download. The latest snapshot is listed first. By selecting other snapshots you will be able to download all previous versions of the backup. 5. Choose where to save the backup (make sure you have enough space on your disk. Passware Kit will display the size of the backup to be downloaded). 6. Choose the format you want to save the backup in. By default, it is the "itunes default format" readable by Apple itunes. You can also save the backup in plain readable format, i.e. without itunes default folders, but as a plain list of files. 7. Click Next. 8. The acquisition process starts. Passware Kit downloads the necessary backup files from icloud to your local computer.

81 9. The full ios backup is now downloaded. Now that you have acquired the ios backup from icloud, you are ready to analyze it with Oxygen Forensic Passware Analyst or open it with Apple itunes to see the device data.

82 Recovering Lost Internet and Network Passwords You can use the Passware Kit to recover your account, Internet, and Network connection passwords. To get started, display the Passware Kit Start Page, and click Recover Internet and Network Passwords (or press Ctrl+I). This displays the following window: What do you want to do? Recover a lost password Recover a lost Internet password Recover a lost network password

83 Recovering Passwords The Passware Kit can recover passwords associated with Microsoft Outlook and Outlook Express accounts, data files and identies. To recover one of these passwords, follow these steps: 1. Display the Passware Kit Start Page. 2. Click Recover Internet and Network Passwords (or press Ctrl+I). 3. Click on the appropriate choice in the Passwords area of the window. The password recovery process begins. The results are displayed when it is finished. The figure below shows a sample result.

84 Recovering Internet Passwords The Passware Kit can recover passwords associated with websites in browsers and with Internet Explorer Content Advisor. To recover one of these passwords, follow these steps: 1. Display the Passware Kit Start Page. 2. Click Recover Internet and Network Passwords (or press Ctrl+I). 3. Click on the appropriate choice in the Internet Passwords area of the window. The password recovery process begins. The results are displayed when it is finished. The figure below shows a sample result.

85 Recovering Network Connection Passwords The Passware Kit can recover passwords associated with VPN and dialup accounts as well as remote desktop accounts. To recover one of these passwords, follow these steps: 1. Display the Passware Kit Start Page. 2. Click Recover Internet and Network Passwords (or press Ctrl+I). 3. Click on the appropriate choice in the Network Passwords area of the window. The password recovery process begins. The results are displayed when it is finished. The figure below shows a sample result.

86 Resetting a Windows Administrator Password What do you want to do? Learn how to reset a Windows password with Passware Kit CD / USB disk Find out what versions of Windows are supported

87 Using a Password Reset CD / USB Disk With Passware Kit, you can reset a password for any local or Active Directory Administrator account. The overall steps are as follows: 1. Create a password reset CD/USB image and burn it on a disk 2. Reset the password with the CD or USB disk

88 Creating a Password Reset CD Image / USB Disk Below are the steps to create an ISO image file for a password reset CD or USB disk. 1. On the Start Page click Reset Windows Administrator Password. The following screen appears. 2. Insert your Windows Setup CD. NOTE: Both Windows 32-bit and 64-bit Setup CDs are supported. Browse for either a TXTSETUP.SIF or a BOOT.WIM file. The TXTSETUP.SIF file is usually located in the 'I386' folder of the Windows XP/2003 Setup CD. The BOOT.WIM file is usually located in the 'Sources' folder of the Windows 8/7/Vista/2008 Setup CD. The Make password reset image from field should contain the location of the TXTSETUP.SIF or BOOT.WIM file; You can protect the Windows Key password reset media with a password by enabling the Set a password on the Windows Password Reset CD/USB disk check-box and typing your own password in the field; Check Add drivers for SCSI/RAID hard drives, if you need to reset a Windows password for a SCSI/RAID/IDE hard drive. The field Copy drivers from should contain the location of the additional drivers for your hard drive. These drivers should be listed in the Pick up the drivers for your hard drive field. For example, drivers for Intel hard drives can be downloaded at the manufacturer's site.