Password Recovery
Find it
Home > Support > Using Passware Kit Forensic with EnCase

Using Passware Kit Forensic with EnCase

  McAfee Secure sites help keep you safe from identity theft, credit card fraud, spyware, spam, viruses and online scams  
  Questions? Need assistance before or after purchasing? Contact our Customer Support service!  
  Want to see how the software works? Sign up for a free webinar.  
  Today I was able to open a TrueCrypt Volume in a very important case. All the relevant information for the case has been in there. Other products have failed before. Thank you Passware!
Matthias Berg,
Hessisches Landeskriminalamt,
Detective Inspector.

Wow! I have worked with and taught a number of forensic software tools, but Passware Kit Forensic is the top dog. From lost passwords to complete Bitlocker and TrueCrypt Volume recovery. This is an absolute must for security and IT Professionals.
Andy Malone,
Microsoft MVP,
Cybercrime Security Forum & Microsoft TechEd 2010 Speaker.

33.5 MB
Buy Now
Buy Now 10 Pack

Related Products

Using Passware Kit Forensic with Guidance Software EnCase.

All Guidance EnCase users can now utilize Passware Kit Forensic to detect and decrypt encrypted files in a case. Thanks to integration with Passware Kit Forensic, EnCase can detect over 200 encrypted file types and initiate a password recovery process if required.


  • EnCase 7.x or later (32-bit).
  • Passware Kit Forensic 11.7 or later ("Install for all users" option selected).

How-To for EnCase v7 and Higher

1. Launch EnCase and open a case file.

2. Click "Process Evidence". The information about encrypted files will be displayed in the "Protected" and "Protection complexity" columns of EnCase.

3. Right-mouse click on the file you would like to open:

Open With Passware Kit

4. Choose Open With -> Passware Kit. Passware Kit Forensic will be launched as a File Viewer and the password recovery process will start automatically.

5. After the file is decrypted or the password is recovered, you can open the file directly from Passware Kit Forensic.

How-To for EnCase v6

If you are using EnCase v6, you can still use the encryption detection capabilities of Passware Kit Forensic via EnScript. The sample EnScript bookmarks all the password-protected or encrypted files for further analysis. Passware Kit Forensic 10.3 or later is required in this case.

1. Launch EnCase and open a case file.

2. Add C:\Program Files (x86)\Passware\Passware Kit\EnCase\PasswareSample.EnScript

3. Select Entries you would like to scan.

4. Run PasswareSample.EnScript

5. All the encrypted or password protected entries will be bookmarked and additional information will be written to the Console:

EnCase Encryption Scanning

  Copyright © 1998 2015 Passware