Passware — a provider of password recovery, decryption, and electronic evidence discovery software for computer forensics, law enforcement organizations, government agencies, and private investigators — has announces the addition of a hardware-accelerated FileVault2 password recovery option to its disk decryption feature in Passware Kit Forensic, originally released in 2012.
Passware’s previous solution relied on memory analysis for extraction of FileVault2 encryption key. While the decryption process was a matter of minutes, in many cases it was unavailable to computer forensics, because often the target Mac was shut down making the encryption keys no longer available in the memory. Passware adds the new option in response to increased demand on Mac forensics, says CEO Dmitry Sumin.
Now Passware offers a brute-force recovery of the FileVault2 password that works with the disks images, regardless of whether the computer is still running or not. Acceleration of Passware’s password recovery process for FileVault2 is possible with graphic processing units (GPUs), such as NVIDIA and AMD, which provides a record password recovery speed — over 4,000 passwords per second with a single GPU card, Sumin says. Further acceleration is possible with distributed computing that Passware offers in the Forensic edition of its software product. Modern GPUs that are now in great demand for mining cryptocurrencies, like Bitcoins, are also good for password cracking.
Other features of Passware Kit Forensic 13.1 include GPU-accelerated password recovery for Android physical images, decryption of QuickBooks and Quicken 2014 databases, and a doubling of the password recovery speed for most types of files.
Passware Kit Forensic is available directly from Passware and a network of resellers worldwide. The price is US$995 with one year of free updates.
Passware enhances FileVault2 decryption on Mac OS X
