Passware Kit Forensic 2018 v1 can decrypt the Apple Files System

Passware, Inc. — a provider of password recovery, decryption, and electronic evidence discovery software for computer forensics, law enforcement organizations, government agencies, and private investigators — has released Passware Kit Forensic 2018 v1. The new version leverages advanced methods to decrypt the new Apple Files System (APFS) disks, which include memory analysis and leaked passwords dictionary, according to CEO Dmitry Sumin.

APFS is a proprietary file system introduced as part of macOS High Sierra. After decryption of an APFS disk, computer forensics can further extract and decrypt a keychain file, which provides access to dozens of user login credentials with the help of Passware Kit Forensic 2018 v1.

According to Sumin, when a memory image of a target Mac is available, the decryption takes only minutes to perform. In cases in which live memory analysis isn’t an option, Passware Kit uses a “brute force” approach to recover the APFS user password.

In brute force password recovery, Passware Kit uses a new passwords dictionary that significantly increases the chances of recovering even complex passwords, Sumin claims. The new dictionary contains over 2.5 billion passwords compiled by Passware from the recent passwords leaks. This dictionary is now available to all active Passware Kit customers for download at their customer portals.

Passware Kit Forensic is available directly from Passware and a network of resellers worldwide. The price is $995 with one year of free updates.