A comprehensive forensic investigation seldom involves the analysis of a single device. It constitutes complex research that requires data acquisition from various devices and multiple cases.

Starting from 2023 v5 Passware Kit Mobile features a multi-window mode. This means that it can recover passcodes and extract data from multiple Apple and Android devices concurrently.

The multi-window mode simplifies the passcode recovery for Apple devices and speeds up the utilization of PKM significantly. Some limitations apply.

• Multi-window mode features
  • Launching a new PKM window
  • Preparing and transferring Apple device to another machine
  • Changing the device description
  • Displaying detailed device information
  • Accessing the project folder
  • Navigating through the opened windows
  • Running concurrent data extraction, passcode recovery, and decryption processes
• Limitations

Multi-window mode features

Launching a new PKM window

Use the “+” button to open a new Passware Kit Mobile window (=instance) and start processing a new device.

Preparing and transferring Apple device to another machine

As Apple device preparation may be unstable on some machines, you can prepare the device on one machine and continue the data extraction on another window. After the preparation is complete, use the Transfer to another computer option and follow the on-screen instructions to continue processing the device on another computer.

Changing the device description

When working with multiple devices simultaneously on a single machine, it may be hard to navigate between them. You can change the device description in the title window for your convenience.

Displaying detailed device information

All the details of about the device and its passcode settings are displayed at the top of the window.

The displayed information includes:

• CPU (chipset)
• Data size
• Encryption type (full-disk, file-based)
• Secure Startup (applicable to Android devices with full-disk encryption)
• Password recovery information
  • Hybrid, on Device
    PKM uses device and workstation hardware for password recovery
  • Hybrid, Unsupported
    The device has an unsupported encryption algorithm
  • Accelerated, On Workstation
    PKM uses workstation hardware to accelerate password recovery
• Password information (if known)
  • Type
  • Length
  • Characters used

Accessing the project folder

The project folder containing a pkm_project.pwproj file, extracted userdata, and decrypted app data, can be accessed using the shortcut in the top right corner.

Navigating through the opened windows

To simplify the navigation between the processes, use the window preview option that shows the device description and the project folder path (Windows only).

Running concurrent data extraction, passcode recovery, and decryption processes

A single workstation can perform data extraction for both Apple and Android devices at the same time. Passcode recovery for Apple devices and GPU-accelerated passcode recovery for Android devices with further data decryption can be run concurrently as well. With these capabilities, Passware Kit Mobile is an ideal solution for addressing a backlog of locked Apple and Android devices.

Limitations

• It is the best to run only one device preparation at a time. If you run several processes, the device preparation might fail.
• During Apple device preparation, do not initiate any other USB connections with other devices.
• Use a USB hub with an external power supply when processing several devices on a single machine.
• The GPU is used by the first PKM window launched. For the newly launched PKM windows, the GPU can be enabled manually, but it will be automatically disabled for the previous PKM window.
• All options and settings that are changed/updated in any of the currently running PKM windows will not be applied to any PKM instances that are already open and will be applied only to the current and subsequent windows of PKM.
• The Dictionary Manager can only be opened within a single PKM window at a time.
• Product Key(s) entered into the License Manager in any of the currently running PKM instances will not be applied to the previously opened windows and will be applied to the current and subsequent windows of PKM. The same Product Key can be applied to any number of windows.
• All the passwords recovered by multiple windows will be added to the Known Passwords Dictionary and to the Previous Passwords attack for current and subsequent windows of PKM.
• Closing Passware Kit Mobile from the taskbar, auto-updating the software or adding environment variable in Tools | Options | Troubleshooting will close all running windows of PKM. This may cause progress loss. Make sure to stop all processes in all windows before closing the software.
• Processing several mobile devices requires sufficient storage. Please plan accordingly.

Passware Tip: To avoid errors, connect and prepare devices consecutively. After the device preparation finishes, data extraction and password recovery processes can be run concurrently.

Instructions on how to transfer the device passcode recovery process to a different machine.

Please feel free to share your feedback and improvement ideas with us.