Passware Kit 2026 v4 brings a major update to BitLocker decryption. It now works with more AMD-based devices and can recover the BitLocker PIN before decryption on AMD Zen/Zen+ systems and, as of this release, on Lenovo devices too. The release also adds the YellowKey method, making BitLocker decryption simpler than ever.
BitLocker is the headline, but the release has several other new features. Passware Kit can now decrypt eCryptfs-encrypted data from Linux and save decrypted full-disk encryption (FDE) images and containers in E01 format.
For Apple-related cases, the release adds password recovery for iWork 2026 files, native application for Apple silicon (in Beta version), and compatibility with macOS 27 Golden Gate.
For your convenience, we have included a video of all the latest features of Passware Kit 2026 v4. Take a look!
Support for an extended list of AMD Zen/Zen+ devices
Passware Kit now supports AMD processors with integrated graphics, such as Raven Ridge, in its decryption solution for BitLocker-protected devices that use firmware TPM (fTPM). Supported AMD Zen/Zen+ families include Summit Ridge, Whitehaven, Pinnacle Ridge, and Raven Ridge, now covering not only desktops, but laptops as well.
Passware Kit recovers the BitLocker Volume Master Key (VMK), so forensic professionals can decrypt the device in minutes. If the device is protected with “TPM and PIN,” Passware Kit recovers the PIN first. It automatically detects whether the PIN is numeric or alphanumeric. GPU acceleration and distributed computing speed up PIN recovery even more.
BitLocker PIN recovery for Lenovo devices
Passware Kit 2026 v4 can recover the BitLocker PIN on TPM-protected Lenovo devices before decrypting them. Along with the ThinkPad E, L, P, T, and X series laptops already supported, the list now includes the popular Lenovo V110.
BitLocker decryption with YellowKey method
Passware Kit now includes the YellowKey method, described in our earlier article. Boot the encrypted device from a USB drive created with Passware Kit, and if the device is supported, the BitLocker Recovery Key appears on its screen.
The method works on x64 systems that run Windows 11, Windows Server 2022, or Windows Server 2025, have BitLocker with TPM protection enabled, and boot to the Windows login screen. Other requirements are described in the article.
Decryption of eCryptfs
Passware Kit now decrypts eCryptfs, the file-based encryption used to protect Linux home folders. Passware Kit recovers the password from the wrapped-passphrase file and then decrypts the entire folder, preserving its structure.
Password recovery runs at over 47,000 passwords per second on an NVIDIA GeForce RTX 4070 Ti.
Saving decrypted images in E01 format
Passware Kit can now save decrypted disk images, volumes, and containers in E01 (EnCase Evidence File) format, so users can analyze them right away in popular forensic tools. This option can be enabled in Tools | Options | Files and Folders | Disk decryption output.
Extended support for VeraCrypt Portable
Memory analysis now supports VeraCrypt Portable through version 1.26.15. It examines memory images to recover the encryption keys of the target containers. Version 1.26.15 is fully supported for both memory analysis and brute-force recovery.
Password recovery for iWork 2026 files
Passware Kit 2026 v4 adds password recovery for iWork 2026 files: Pages, Numbers, and Keynote. On an NVIDIA GeForce RTX 4070 Ti, recovery speed reaches up to 90,000 passwords per second.
Compatibility with macOS 27 Golden Gate
Passware Kit 2026 v4 supports the newly released macOS 27 Golden Gate – both running on it and recovering passwords or decrypting data from its artifacts: iWork files, Apple Notes, iOS 27 backups, and System Keychain.
Usability improvements for the USB workflow
Passware has improved its USB drive workflow – an essential process for Windows password reset, memory acquisition with the Passware Bootable Memory Imager (PBMI), and BitLocker decryption with the Passware Bootable Analyzer (PBA), Passware TPM Kit, and YellowKey USB.
The updated workflow adds precise troubleshooting and detailed UI messages.
Beta version: native application for Apple silicon (ARM)
A Beta version of Passware Kit Forensic now runs natively on Apple silicon, harnessing the ARM architecture for password recovery. This feature has some limitations in its current form and is available on request to Passware Kit Forensic and Ultimate customers with active licenses.
Passware BitLocker Wizard
Passware offers several BitLocker decryption methods, depending on your target environment and the evidence at hand. To find the right one, use the Passware BitLocker Wizard – it will point you to the decryption solution that fits your case.
Comments
0 comments
Article is closed for comments.