Password Recovery
Find it
     
 
Home > Support > Using Passware Kit Forensic with EnCase
 
 

Using Passware Kit Forensic with EnCase

 
     
     
     
   
   
     
     
   
  McAfee Secure sites help keep you safe from identity theft, credit card fraud, spyware, spam, viruses and online scams  
     
     
   
  Questions? Need assistance before or after purchasing? Contact our Customer Support service!  
     
     
   
  Want to see how the software works? Sign up for a free webinar.  
     
     
   
  Today I was able to open a TrueCrypt Volume in a very important case. All the relevant information for the case has been in there. Other products have failed before. Thank you Passware!
Matthias Berg,
Hessisches Landeskriminalamt,
Detective Inspector.

Wow! I have worked with and taught a number of forensic software tools, but Passware Kit Forensic is the top dog. From lost passwords to complete Bitlocker and TrueCrypt Volume recovery. This is an absolute must for security and IT Professionals.
Andy Malone,
Microsoft MVP,
Cybercrime Security Forum & Microsoft TechEd 2010 Speaker.

 
     
     
 
$995
33.5 MB
Download
Buy Now
Buy Now 10 Pack

Related Products

Using Passware Kit Forensic with Guidance Software EnCase.

All Guidance EnCase users can now utilize Passware Kit Forensic to detect and decrypt encrypted files in a case. Thanks to integration with Passware Kit Forensic, EnCase can detect over 200 encrypted file types and initiate a password recovery process if required.

Requirements:

  • EnCase 7.x or later (32-bit).
  • Passware Kit Forensic 11.7 or later ("Install for all users" option selected).

How-To for EnCase v7 and Higher

1. Launch EnCase and open a case file.

2. Click "Process Evidence". The information about encrypted files will be displayed in the "Protected" and "Protection complexity" columns of EnCase.

3. Right-mouse click on the file you would like to open:

Open With Passware Kit

4. Choose Open With -> Passware Kit. Passware Kit Forensic will be launched as a File Viewer and the password recovery process will start automatically.

5. After the file is decrypted or the password is recovered, you can open the file directly from Passware Kit Forensic.

How-To for EnCase v6

If you are using EnCase v6, you can still use the encryption detection capabilities of Passware Kit Forensic via EnScript. The sample EnScript bookmarks all the password-protected or encrypted files for further analysis. Passware Kit Forensic 10.3 or later is required in this case.

1. Launch EnCase and open a case file.

2. Add C:\Program Files (x86)\Passware\Passware Kit\EnCase\PasswareSample.EnScript

3. Select Entries you would like to scan.

4. Run PasswareSample.EnScript

5. All the encrypted or password protected entries will be bookmarked and additional information will be written to the Console:

EnCase Encryption Scanning

 
 
 
 
     
   
     
   
     
   
     
  Copyright © 1998 2014 Passware