Passware Kit 2022 v3 – Deleted Data Recovery from Encrypted FileVault/APFS Images

What’s new in Passware Kit 2022 v3:

  • Recovery of deleted data for APFS images
  • Decryption of QuickBooks for Mac 2022 databases
  • GPU acceleration for bcrypt password recovery
  • Updated password recovery for Acronis backups
  • Password recovery for Dashlane for Mac
  • Improved Rainbow Tables attack
  • UI improvements
  • Faster startup

What’s New Video

For your convenience, we have included a video below of all the newest features of Passware Kit 2022 v3.

The deleted data of an encrypted disk can be of particular importance for discovering electronic evidence. Passware adds a new option to its FileVault/APFS decryption feature – deleted data recovery. It decrypts and creates an image of the unallocated volume data that may contain deleted data.

In addition, Passware Kit 2022 v3 instantly decrypts QuickBooks for Mac 2019–2022 databases, extracts passwords from Dashlane password manager for Mac, expands the range of supported Acronis versions, speeds up bcrypt password recovery on GPU, and works 25% faster with Rainbow Tables.

Get straight to decrypting and recovering passwords because the new Passware Kit starts faster than ever!

Recovery of deleted data for APFS images

To simplify the configuration of FileVault/APFS decryption, we have redesigned the setup process. First, the software lists the volumes, accounts, and the corresponding options: memory image, iCloud credentials, T2 decryption add-on, and others.


Get The Latest DFIR News

Join the Forensic Focus newsletter for the best DFIR articles in your inbox every month.

Unsubscribe any time. We respect your privacy - read our privacy policy.


Passware Kit can now decrypt unallocated volume data that may contain deleted data.

Decryption of QuickBooks for Mac 2022 databases

Passware Kit 2022 v3 instantly decrypts QuickBooks for Mac 2019–2022 databases. For Windows versions of QuickBooks, a password recovery option is available.

GPU acceleration for bcrypt password recovery

Password recovery for bcrypt (Blowfish) hash files can now be accelerated on GPUs: both NVIDIA and AMD cards. For example, recovery speed on an AMD Radeon RX 6900 XT is up to 70,000 passwords per second for a default 10-cost hash.

Updated password recovery for Acronis backups

In addition to password recovery for Acronis 2016–2021 backup files, Passware Kit now supports earlier versions of Acronis, i.e., 2010–2016, with the *.TIB file extension. Password recovery can be accelerated on NVIDIA and AMD GPUs, reaching speeds of more than 2,600,000 passwords per second for an Acronis 2016 file on an AMD 6900 XT.

The password recovery process for Acronis files is now more stable and starts faster than ever.

Password recovery for Dashlane for Mac

Passware Kit 2022 v3 adds support for Dashlane on macOS. It recovers a master password and extracts records from the app’s databases. Depending on the Dashlane settings and encryption algorithm, it can also use GPU acceleration to recover the master password.

Improved Rainbow Tables attack

Passware Rainbow Tables attack, which decrypts MS Office files up to version 2003 and Windows NTLM hashes, now supports hybrid Rainbow Tables. It also processes RTI2 tables 25% faster than before, completing the decryption process within minutes.

UI improvements

On the “Passwords Found” tab, there is now a “View attack” option next to the recovered password, which displays the settings of the successful attack that found the password. These settings can be exported and applied to other password-protected items.

The list of dictionaries is now displayed more clearly, with separate sections for built-in and custom word lists.

Faster startup

All editions of the Passware Kit have been optimized for faster startup. Start decryption right away!

More information about this release on Passware website.

Leave a Comment