General Questions about Passware Kit Mobile

Passware Kit Mobile is an easy-to-use Android and iPhone forensics tool that extracts and decrypts data, recovers patterns, open passwords or PIN locks, and decrypts Signal Messenger, Wickr Me, and 1Password data.

• Q: What devices does Passware Kit Mobile support?
• Q: How is Passware Kit Mobile licensed?
• Q: Does Passware Kit Mobile require the Internet to work?
• Q: Is the acquisition and decryption process forensically sound?
• Q: What steps should be performed before using Passware Kit Mobile for extraction?
• Q: What are the software and hardware recommendations for Passware Kit Mobile?
• Q: How can I get updates for Passware Kit Mobile?
• Q: I have received an error during the recovery process. How can I report it?
• Q: What if I am brute-forcing the device and the machine loses power or restarts? Will I lose progress and get an extraction charged from my license balance?
• Q: I only need to recover the passcode. Can I skip the data extraction step?
• Q: How can I change the password recovery settings if the software fails to recover the password?
• Q: Is it possible to transfer the device passcode recovery process to a different machine? Can I transfer it from Windows OS to macOS?
• Q: Does Passware Kit Mobile support DAR archives?
• Q: Does Passware Kit Mobile support Second Space on Android Devices?

Q: What devices does Passware Kit Mobile support?

The full list of supported devices can be checked on the Passware website:
https://www.passware.com/kit-mobile/devices/ 
If your device is not listed, please use Passware Kit Mobile to submit a Feature Request or specify the exact device model to Customer Support.

Q: How is Passware Kit Mobile licensed?

Passware Kit Mobile is licensed per user. Each user may install and use the software product on up to 5 computers simultaneously.
The software is available for law enforcement and other types of government organizations and private companies with justifiable business needs, such as forensic firms or corporate investigation teams. We do not sell to individuals.
All orders are subject to manual verification.
NOTE: There is no free demo version of Passware Kit Mobile available and no support for distributed password recovery. However, there is a Trial Annual version for 5 extractions.

Please check license options at our website.

Q: Does Passware Kit Mobile require the Internet to work?

Yes. At the last step of the device data extraction, Passware Kit Mobile requires a connection to the Internet to verify the number of extractions available and start the passcode recovery and decryption process. It may also require the Internet for some Apple devices before the data extraction begins.
The special edition of Passware Kit Mobile for workplaces without Internet access is available within the Passware Kit Ultimate – Air-Gapped Edition bundle.

Q: Is the acquisition and decryption process forensically sound?

Passware Kit Mobile creates a forensically sound encrypted image by bit-by-bit extraction of the mobile device’s storage. In case of a successful passcode recovery, it extracts encryption keys and decrypts the files from the extracted image.
No data is saved to the device, all the steps are performed in memory, and partitions/volumes are not mounted during the extraction and decryption processes. All possible image differences are the result of the changes performed by the OS itself (due to the file system particularities), and they do not affect the user’s volume.

Q: What steps should be performed before using Passware Kit Mobile for extraction?

• Make sure there is enough storage space on the computer: there should be at least the same space as the mobile device storage.
• The mobile device should be fully charged.
• Make sure there are no applications like iTunes, third-party forensic tools, etc., that might be using the device or device drivers running on the same machine.
• Use an empty folder for each new project.

Q: What are the software and hardware recommendations for Passware Kit Mobile?

Q: How can I get updates for Passware Kit Mobile?

Passware Kit Mobile is updated on a regular basis with new features, bugfixes, and software improvements. If a new version is available, you will get an update notification on the software launch and the prompt to perform an auto-update, as well as an email notification. You can also check for updates manually at the Help | Check for updates menu, or download the latest version from your Passware account.

Q: I have received an error during the recovery process. How can I report it?

If there is an error reported by Passware Kit Mobile, please click “Show details” to see the “Bug report”:

a) If the description refers to the USB connection issue, please make sure the mobile device is fully charged and try the options below:

• Reboot the mobile device. Make sure it turns on.
• Reboot the computer.
• Use a different USB port on your computer.
• Use a different USB cable.
• Use a different computer to perform the acquisition.

If none of the above helps, please contact Customer Support.

b) If the error description does not refer to the USB connection, click “Save” and send the created archive along with the logs, output folder (without user data file), screenshots, device model, and the description of the issue to Customer Support.

Q: What if I am brute-forcing the device and the machine loses power or restarts? Will I lose progress and get an extraction credit charged from my license balance?

The recovery state is saved automatically, even if the computer gets powered off or reboots. To continue the recovery process, the steps should be as follows:

1. Launch Passware Kit Mobile
2. On the Start Page, select the latest project on the Recent Project tab
3. Follow the on-screen instructions to resume the recovery process.

The number of extraction credits available for your license will not be affected.

Q: How can I change the password recovery settings if the software fails to recover the password?

On the recovery screen or screen with the unsuccessful result, click the “Back" arrow in the top left corner. You will get back to the batch mode screen, where you can change the attack settings. Passware Kit Mobile can use the same password recovery attacks and settings as Passware Kit Forensic.

NOTE: When clicking the “Back" arrow from the password recovery progress screen, the previous process might take up to several minutes to finish. Please leave the mobile device connected.

Q: Is it possible to transfer the device passcode recovery process to a different machine? Can I transfer it from Windows OS to macOS?

Yes, the recovery process for Android and iOS devices can be transferred to another machine. The steps are as follows:
1. Click “Stop” and close Passware Kit Mobile;
2. Copy all files from the corresponding folder from the current machine to the target one:

For Windows OS:
%APPDATA%\Roaming\Passware\Passware Kit Mobile\recovery-states
C:\ProgramData\Passware\Passware Kit Mobile (if installed for “All users”)

For macOS:
Users/<Current User>/Library/Application Support/Passware/Passware Kit Mobile/recovery-states

3. Copy the entire project folder with the extracted data to the target machine;
4. Install Passware Kit Mobile on the target machine. Make sure to add the Product Key used to attack the device (where the credit was taken from);
5. Launch Passware Kit Mobile and click "Open Project" from the right pane and choose the pkm_project.pwproj file from the copied project folder;
6. Connect the mobile device if needed;
7. On the next screen, click "Recover" to continue from the last saved recovery state.

Q: Does Passware Kit Mobile support DAR archives?

Yes. Passware Kit Mobile can save the extracted data file for Apple and Android devices with file-based encryption in the following formats:

• DAR v9 (supports item creation time)
• DAR v8 (compatible with most forensic tools)
• Plain filesystem

We recommend using DAR v8 format so that the image can be properly analyzed by third-party forensic applications (mount as "Image").

NOTE: MediaTek-based devices and Exynos-based Samsung devices with full-disk encryption support EXT4 file system image in DD format as output files only.

Q: Does Passware Kit Mobile support Second Space on Android Devices?

Second Space is a popular feature among Android users for creating separate user environments on the same device. Passware Kit Mobile allows users to uncover Second Space profiles, recover account passwords and retrieve associated app credentials and private data.

PKM works with all devices with File-Based Encryption.

_______________________

Overview of Passware Kit Mobile
Apple devices
Huawei Kirin-based devices
MediaTek-based devices
Qualcomm-based devices
Unisoc-based devices