Passware Kit Forensic 2018 Quick Start Guide

Transcription

1 Passware Kit Forensic 2018 Quick Start Guide This guide will walk you through the basic password recovery and decryption tasks Task 1: Detecting encrypted files and containers Task 2: Recovering a file password Task 3: Extracting passwords from a memory image Task 4: Decrypting a Keychain Task 5: Decrypting a VeraCrypt container Task 6: Using a custom dictionary Task 7: Customizing password recovery settings 1

2 Task 1: Detecting encrypted files and containers 1. On the Start page, click Find Encrypted Files: 2. Enable checkbox Scan for encrypted containers and disk images, click Browse and choose folder 1-DetectingEncryptedFiles to scan: 2

3 Click Scan. 3. Passware Kit lists the encrypted files along with the detailed information about them, such as: Recovery Complexity, Protection Flags, Date Modified, etc. Click Recovery Complexity to sort the files by the encryption strength. 3

4 4. Optionally: Select the files you want to decrypt starting from files with Instant Unprotection complexity and moving on to files with stronger encryption, such as archives or containers. Click Recover Password to proceed with password ecovery and decryption in batch mode. 4

5 5

6 Task 2: Recovering a file password 1. On the Start page, click Recover File Password: 2. Locate file Clover.doc and click Open. 6

7 3. Choose Use Predefined Settings: 7

8 4. Passware Kit applies its default dictionary to the file and recovers the password: 8

9 Task 3: Extracting passwords from a memory image (Passware Kit Forensic only) 1. On the Start page, click Memory Analysis: 2. At the Memory image field click Browse and locate file memory-mac.img. Click Open. 9

10 3. Enable checkboxes Mac User and Websites. Click Next: 4. Passware Kit extracts passwords for Mac users, as well as the list of open websites along with their login credentials 10

11 11

12 12

13 Task 4: Decrypting a Keychain (Passware Kit Forensic only) By default settings of macos, a Keychain password is the same as a Mac user password. Passware Kit leverages this feature to recover Keychain passwords with its dictionary, which includes previously recovered passwords for Mac users (in Task 3). The previously recovered passwords are automatically saved in Passware Kit dictionary to be reused for subsequent files. 1. On the Start page, click Recover File Password: 13

14 2. Locate file johndoe.keychain and click Open. 3. Click Use Predefined Settings: 4. Passware Kit runs default password recovery attacks, which include a dictionary with the previously found passwords. The File-Open password is recovered in seconds and Passware Kit extracts all the login credentials from the Keychain: 14

15 15

16 Task 5: Decrypting a VeraCrypt container 1. On the Start page, click Full Disk Encryption: 2. Choose VeraCrypt. 16

17 3. Click I have a memory image tab: 4. At the Encrypted VeraCrypt volume image file field click Browse, set All files (*.*) from the pull-down menu of the File name field and locate file vc.hc: 17

18 The decrypted volume image will be saved in the Destination file location. 18

19 5. At the Physical memory image file field click Browse and locate file vcmemory.bin. Click Decrypt: 19

20 6. Passware Kit removes the VeraCrypt encryption key and saves the decrypted image file: 20

21 Task 6: Using a custom dictionary Password for file Capital.zip is a capital name. To recover this type of password, use a list of capitals as a custom dictionary file. Such a list could be created manually as a text file or downloaded from wordlist resources, such as ftp://ftp.cerias.purdue.edu/pub/dict 1. On the Start page, click Recover File Password: 2. Locate file Capital.zip and click Open. 21

22 3. Click Advanced: Customize Settings: 4. Passware Kit displays the settings of the default password recovery attacks. Click Remove All to clear the list and start with your own settings: 22

23 23

24 5. Click Add Attack : 6. At the Dictionary Attack settings, choose Custom from the Dictionary pulldown menu: 24

25 7. At the Custom Dictionary Compiler window, click Browse, locate file capitals.txt (a custom list of capitals, which is supposed to be used as a dictionary) and click Open. Click Compile to proceed: 25

26 8. Passware Kit compiles the text file into a dictionary named Unfiltered-capitalsdictionary. Select this dictionary and click Add Attack. 26

27 27

28 9. Click Recover to proceed with the custom settings: 28

29 10. Passware Kit recovers the password for the file using the custom dictionary: 29

30 Task 7: Customizing password recovery settings If a pattern for a password is known, it can be specified in Passware Kit settings. For example, password for file placesihavebeen.zip is a city name followed with a year, i.e. London2015, Amsterdam2000, etc. To recover this type of password, use a custom dictionary file from Task On the Start page, click Recover File Password: 2. Locate file placesihavebeen.zip and click Open. 30

31 3. Click Advanced: Customize Settings: 4. Passware Kit displays the settings of the default password recovery attacks. Click Remove All to clear the list and start with your own settings: 31

32 32

33 5. Click Add Attack : 6. To specify pattern city + year, click Join Attacks. You will need to join a Dictionary (city names) attack and a Brute-force attack (numbers) together. Specify the overall range of password Length, if known: from 5 to 10 characters in this example. Click Add Attack: 33

34 34

35 7. Click [+] and choose a Dictionary attack: 8. From the Dictionary pull-down menu, choose Unfiltered-capitals-dictionary, which was previously compiled in Task 6 (steps 6-8 of Task 6). Click Add Attack: 35

36 9. Click [+] and choose a Brute-force attack: 36

37 10. At the Brute-force Attack settings, specify the length of the password s part: if it is a year, the range of Length is from 4 to 4 characters. Specify the Symbol Set: enable checkbox Numbers and disable all other checkboxes. At the Advanced Settings section, specify the Pattern of the passwords s part: if it is a year of current century, the pattern is 20* (the password s part will look like 2000, 2001,, 2099). Click Add Attack: 37

38 38

39 11. Click Recover to proceed with the custom settings: 39

40 12. Passware Kit recovers the password for the file using the custom settings: Congratulations! You have successfully completed all the tasks! 40