Passware Kit Mobile is an easy-to-use Android and iPhone forensics tool that extracts and decrypts data, recovers patterns, open passwords or PIN locks, and decrypts Signal Messenger, Wickr, and 1Password data.
- Q: What devices does Passware Kit Mobile support?
- Q: How is Passware Kit Mobile licensed?
- Q: Does Passware Kit Mobile require the Internet to work?
- Q: Is the acquisition and decryption process forensically sound?
- Q: What steps should be performed before using Passware Kit Mobile for extraction?
- Q: What are the software and hardware recommendations for Passware Kit Mobile?
- Q: How can I get updates for Passware Kit Mobile?
- Q: I have received an error during the recovery process. How can I report it?
- Q: What if I am brute-forcing the device and the machine loses power or restarts? Will I lose progress and get an extraction charged from my license balance?
- Q: I only need to recover the passcode. Can I skip the data extraction step?
- Q: How can I change the password recovery settings if the software fails to recover the password?
- Q: Is it possible to transfer the device passcode recovery process to a different machine? Can I transfer it from Windows OS to macOS?
- Q: Does Passware Kit Mobile support DAR archives?
Q: What devices does Passware Kit Mobile support?
The full list of supported devices can be checked on the Passware website:
If your device is not listed, please use Passware Kit Mobile to submit a Feature Request or specify the exact device model to Customer Support.
Q: How is Passware Kit Mobile licensed?
Passware Kit Mobile is licensed per user. Each user may install and use the software product on up to 5 computers simultaneously.
The software is available for law enforcement and other types of government organizations and private companies with justifiable business needs, such as forensic firms or corporate investigation teams. We do not sell to individuals.
All orders are subject to manual verification.
NOTE: There is no free demo version of Passware Kit Mobile available and no support for distributed password recovery.
Q: Does Passware Kit Mobile require the Internet to work?
Yes. At the last step of the device data extraction, Passware Kit Mobile requires a connection to the Internet to verify the number of extractions available and start the passcode recovery and decryption process. Passware Kit may also require an internet connection to start the data extraction process for some Apple devices.
Q: Is the acquisition and decryption process forensically sound?
Passware Kit Mobile creates a forensically sound encrypted image by bit-by-bit extraction of the mobile device’s storage. In case of a successful passcode recovery, it extracts encryption keys and decrypts the files from the extracted image.
No data is saved to the device, all the steps are performed in memory, and partitions/volumes are not mounted during the extraction and decryption processes. All possible image differences are the result of the changes performed by the iOS itself (due to the file system particularities), and they do not affect the user’s volume.
Q: What steps should be performed before using Passware Kit Mobile for extraction?
Make sure there is enough storage space on the computer: there should be at least twice as much space as the mobile device storage.
The mobile device should be fully charged.
Make sure there are no applications like iTunes, third-party forensic tools, etc., that might be using the device or device drivers running on the same machine.
Use an empty folder for each new project.
Q: What are the software and hardware recommendations for Passware Kit Mobile?
|Operating System||OS Versions||Processor||USB ports|
Recommended for Apple devices
|Monterey (12), Big Sur (11), Catalina (10.15), or Mojave (10.14)||Intel processors and the 2013-2019 production year||USB-A adapters instead of USB-C|
Recommended for Huawei devices
|11, 10, 8.1||USB 3.1 Gen 1 ports instead of USB 3.1 Gen 2 Type A|
Q: How can I get updates for Passware Kit Mobile?
Passware Kit Mobile is updated on a regular basis with new features, bugfixes, and software improvements. If a new version is available, you will get an update notification on the software launch and the prompt to perform an auto-update, as well as an email notification. You can also check for updates manually at the Help | Check for updates menu, or download the latest version from your Passware account.
Q: I have received an error during the recovery process. How can I report it?
If there is an error reported by Passware Kit Mobile, please click “Show details” to see the “Bug report”:
a) If the description refers to the USB connection issue, please make sure the mobile device is fully charged and try the options below:
- Reboot the mobile device. Make sure it turns on.
- Reboot the computer.
- Use a different USB port on your computer.
- Use a different USB cable.
- Use a different computer to perform the acquisition.
If none of the above helps, please contact Customer Support.
b) If the error description does not refer to the USB connection, click “Save” and send the created archive along with the logs, output folder (without user data file), screenshots, device model, and the description of the issue to Customer Support.
Q: What if I am brute-forcing the device and the machine loses power or restarts? Will I lose progress and get an extraction charged from my license balance?
The recovery state is saved automatically, even if the computer gets powered off or reboots. To continue the recovery process, the steps should be as follows:
- Launch Passware Kit Mobile
- On the Start Page, select the last project on the Recent Project tab
- Follow the on-screen instructions to resume the recovery process.
The number of extractions available for your license will not be affected.
Q: I only need to recover the passcode. Can I skip the data extraction step?
Yes. To do this, create an empty .TXT file to the output project folder and rename it to the following (case-sensitive):
For Apple devices with A8 chip and higher: flashStorageExtracted.checkpoint
For Huawei devices: userdataExtracted.checkpoint
The file allows Passware Kit Mobile to skip the data extraction step. The extraction will still be charged from the license balance.
Q: How can I change the password recovery settings if the software fails to recover the password?
On the recovery screen or screen with the unsuccessful result, click the “Back arrow” in the top left corner. You will get back to the batch mode screen, where you can change the attack settings. Passware Kit Mobile can use the same password recovery attacks and settings as Passware Kit Forensic.
NOTE: When clicking the “Back arrow” from the password recovery progress screen, the previous process might take up to several minutes to finish. Please leave the mobile device connected.
Q: Is it possible to transfer the device passcode recovery process to a different machine? Can I transfer it from Windows OS to macOS?
Yes, the recovery process for Android and iOS devices can be transferred to another machine. The steps are as follows:
1. Click “Stop” and close Passware Kit Mobile;
2. Copy all files from the corresponding folder from the current machine to the target one:
For Windows OS:
%APPDATA%\Roaming\Passware\Passware Kit Mobile\recovery-states
C:\ProgramData\Passware\Passware Kit Mobile (if installed for “All users”)
Users/<Current User>/Library/Application Support/Passware/Passware Kit Mobile/recovery-states
3. Copy the entire project folder with the extracted data to the target machine;
4. Install Passware Kit Mobile on the target machine. Launch Passware Kit Mobile and click "Open Project" from the right pane and choose the pkm_project.pwproj file from the copied project folder;
5. Connect the mobile device if needed;
6. On the next screen, click "Recover" to continue from the last saved recovery state.
Q: Does Passware Kit Mobile support DAR archives?
Yes. Passware Kit Mobile 2022.2 or later can save the extracted data file in the following formats:
- DAR v9 (supports item creation time)
- DAR v8 (compatible with most forensic tools)
- Plain filesystem
We recommend using DAR v8 format so that the image can be properly analyzed by third-party forensic applications (mount as "Image").