Recovering Passwords for Multiple Files

Passware Kit supports batch file processing, recovering passwords for multiple files, in an automated way. This option is available in the Business, Forensic, and Ultimate editions.

How to Start

Select multiple files for decryption using the Recover File Password option on the Start Page.

You can also initiate a password recovery for multiple files from the results of the Search for Protected Files option. Select the files (use Ctrl-click to select dedicated files or Shift-click to select multiple items at once) that you want to decrypt from the list of encrypted files displayed by Passware Kit. Then click the Recover button as shown below:

Groups and Settings

Once you have selected the files to decrypt, Passware Kit groups them according to the decryption options:

• Settings Required
  Encrypted disk images and containers as well as files with multiple accounts that require additional setup.
• Known Password
  Items with passwords previously recovered by Passware Kit.
• Instant Recovery
  Items that can be decrypted instantly.
• Default Recovery 
  Items requiring brute-force password recovery.

Passware Tip: You can add custom groups, modify them, delete them, and move files between groups.

The Settings Required group is formed automatically based on the item type. For example, all BitLocker images are grouped together with one of two options:

• Set Up Group…
  Applies the same settings (e.g, destination folder), to all the items in the group.
• Set Up…
  Applies individual settings to each item, such as choosing accounts, destination folders, etc.

Once the setup is complete, the item or multiple items are transferred into the Default Recovery group or into the Custom Group, depending on the chosen settings. Individual accounts and partitions are added as separate items.

For each group (except for Known Password and Instant Recovery groups, for which the password is recovered instantly regardless of its settings) you can use the Predefined settings, or customize them in Attack Editor. Click Attack Settings near the group name to modify attacks for the entire group.

You can also set a timeout for files to be processed. This option applies to each item in the group, and password recovery attacks will stop when the timeout is reached. If the timeout setting is changed during recovery, it will apply only to items still in progress.=

Passware Tip: Click “Back” if you need to change the timeout. Note that the new timeout will only apply to files not yet processed.

By selecting files with Ctrl-click you can click New Group to create a Custom Recovery group and set different timeouts or attack settings for the selected files.

Passware Kit allows you to apply different password recovery settings to the same file by including the file in multiple batch recovery groups. Use the Add Files option or the “+” button next to each group to add duplicates and other files to the list.

Additional functionality includes:

• Sort by complexity: for more convenient triage;
• Save Job: if the recovery job needs to be moved to another computer or saved for later processing;
• Open Job: if you have a previously saved recovery process that you want to resume. 

Passware Tip: Read more about how to transfer a password recovery process to a different computer. 

The Batch mode page features several columns useful for recovery triage and an overview of the password recovery job. They are as follows:

• Item name
  Name of the file or disk image; for some items, it may display an account name or partition.
• Folder
  The folder where the item is located.
• Complexity
  Shows a password encryption value based on encryption strength using flags, e.g., “Hardware acceleration possible”.
• Item Type
  Type and version of the item.
• Protection
  Various flags regarding the item’s protection and its encryption type.
• Hint (if applicable)
  Displays a hint that was set for the item’s password (where applicable).

Recovering the Passwords

Once you have set up the list of files and password recovery attacks, click the Recover button to start the batch password recovery process:

The Items tab lists all the files in the recovery queue, recovered passwords, recovery speed, the number of passwords checked, and the time elapsed since the start of the process. 

While password recovery is in progress, you can pause or stop it. 

NOTE: Some progress may not be saved if you stop the recovery amid process; a pop-up warns that some passwords will be re-checked when you resume. 

Items and recovery groups can be skipped from the Items tab while the running attacks can be managed on the Attacks tab. 

Passware Tip: Check the Resources Manager tab to manage hardware resources and distributed password recovery. 

Passware Kit displays recovered passwords on the Passwords Found tab, and process details on the Log tab. 

If the recovery process is paused or stopped, the Resume Attacks option becomes available. Click Save Job to resume later, transfer the project to another computer, or archive it for future use.

Starting with 2025v4, Passware Kit automatically checks previously recovered passwords against other items in the same batch session. This feature significantly increases the success rate and is enabled by default. You can disable it at Tools | Options | Batch Mode Processing. 

At the end of the process, you can save a report in HTML format. You can also click Save Passwords to save the list of recovered passwords for reference or for future usage as a custom dictionary. 

Passware Tip: You can enable the option to create unprotected files automatically when a password is recovered or reset for supported file types at Tools | Options | Files and Folders and choose a folder for unprotected result files. These unprotected copies can then be ingested by other forensic tools for further analysis.