How to use Passware Kit Forensic with Guidance Software EnCase

All Guidance EnCase users can now utilize Passware Kit Forensic to detect and decrypt encrypted files in a case. Thanks to integration with Passware Kit Forensic, EnCase can detect over 200 encrypted file types and initiate a password recovery process if required.

Requirements:

• EnCase 7.x or later (32-bit).
• Passware Kit Forensic 11.7 or later ("Install for all users" option selected).

How-To for EnCase v7 and Higher

1. Launch EnCase and open a case file.

2. Click "Process Evidence". The information about encrypted files will be displayed in the "Protected" and "Protection complexity" columns of EnCase.

3. Right-mouse click on the file you would like to open:

4. Choose Open With -> Passware Kit. Passware Kit Forensic will be launched as a File Viewer and the password recovery process will start automatically.

5. After the file is decrypted or the password is recovered, you can open the file directly from Passware Kit Forensic.

How-To for EnCase v6

If you are using EnCase v6, you can still use the encryption detection capabilities of Passware Kit Forensic via EnScript. The sample EnScript bookmarks all the password-protected or encrypted files for further analysis. Passware Kit Forensic 10.3 or later is required in this case.

1. Launch EnCase and open a case file.

2. Add C:\Program Files (x86)\Passware\Passware Kit\EnCase\PasswareSample.EnScript

3. Select Entries you would like to scan.

4. Run PasswareSample.EnScript

5. All the encrypted or password protected entries will be bookmarked and additional information will be written to the Console: