===================================================================== Reset Windows Password * Version History * ===================================================================== https://www.passcape.com info@passcape.com ===================================================================== [+] new feature, improvements [*] modification [!] error or bug fix Version 14.2.0 [+] Telegram Desktop investigation tool. This new tool includes 3 features aimed to help you recovering your Telegram passcode, decrypt protected files, and analyze downloads of the Telegram desktop app. [+] Windows media forensics now supports two additional features: the Windows 10/11 Photo Database and the Windows 11 Media Player investigation tools. [*] The SHA512 hashing algorithm has undergone significant improvements. This helps to speed up certain password search algorithms by up to three times. For instance, the password recovery process for Microsoft Office 2013-2021 documents is much much faster now. [*] The logic behind searching for password-protected documents has been significantly revised. Instead of checking a specific disk location, the program now scans the entire disk and instantly displays a list of all password-protected documents found. This new feature is made possible thanks to our brand-new and innovative instant disk search technology. Version 14.1.0 [+] Check out this groundbreaking new feature, exclusive to our program, that lets you explore the history of external IP addresses linked to any user account within the Windows OS. This innovative feature is not available in any other software. [+] Our fast disk lookup feature is designed for efficiently searching for files and their contents on a chosen disk drive. This cutting- edge tool stands out as the fastest Windows file searching solution available. Powered by our innovative algorithms, it sets a new standard for speed among Windows programs, providing users with an unparalleled search experience. [+] The logon policy has new, various local security options now. [+] Some new hard disk drivers were added. [+] The plaintext password recovery engine now decrypts saved passwords of the FAR FTP client. [*] In this update, numerous improvements have been made, including the addition of new password recovery modules. These enhancements extend to the decryption of plaintext passwords for local and domain accounts, as well as for PDF/Office documents, virtual machines, and more. [*] The recent user activity feature has been enhanced to extract and display even more files and folders user accessed recently. [!] A fix for the database incompatibility error when decrypting some SRUM (System Resource Usage Monitor) databases. [!] A buffer overflow bugfix enumerating program timeline. [!] Some interface bugfixes. Version 14.0.0 [+] Statistics and analysis reports have been rewritten from scratch and now feature advanced visualization. Depending on your needs, each report now includes (depending on the type of the report) a lot of additional information such as OS statistics, user profile information, installed hardware or software (e.g., antiviruses or browsers), disk info, and much more. [+] Disk space analyzer: This tool analyzes the disk and visually represents the top files and folders consuming your disk space. Its main advantage is speed, as it is one of the fastest on the Web. [+] File statistics tool: This tool generates extended information on files and folders, including the types and categories files belong to, top largest/newest items and so on. [+] The Windows search database explorer has a new option (set on by default) for extracting information on deleted files and folders. [+] The Windows search database explorer can also create wordlists with all indexed words from the search database. These dictionaries can be used later for further analysis or in any password recovery software. [*] New and more accurate detection algorithm for the last user logon time. [*] Several additional improvements have been made, such as a general enhancement to the Windows product key extraction algorithm, as well as improved hardware detection in certain information dialogs, etc. [*] NVME/SCM/virtual drive type detection in some tools. [*] Numerous interface enhancements. [*] Updated translations for most interface languages. [!] Some interface bugs have been fixed. [!] This version also includes a fix for the incorrect detection of the Active Directory database in the 'Logon History and Statistics' menu. Version 13.2.0 [+] A new tool for removing junk files and cleaning up the registry. [+] A couple of new built-in SSD drivers. [*] Language update for Italian, Russian, Gujarati, and Hindi interfaces. [!] The raw image creation feature was working incorrectly on some configurations. Version 13.1.0 [+] Remote Desktop forensic tools. This is a set of 3 items that allows you to extract passwords of RDP saved connections, view RDP events and analyse RDP cached images. [+] A new and easy-to-use way of searching for BitLocker recovery keys that were saved locally. [+] The backup tool can search and save additional items. Such as Remote Desktop cache, Media player history, BitLocker recovery keys, etc. [+] This version of the program now has the ability to decrypt credit cards stored in popular browsers such as Google Chrome, Microsoft Edge, Opera, and other Chromium-based browsers. [+] This version performs additional checks for password vulnerabilities upon startup. If the program detects that any of your passwords or personal data are at risk or can be decrypted instantly, it displays a corresponding warning. Version 13.0.0 [+] Full support for Windows 11. This version also has some important compatibility fix-ups when working with Windows 11 OSes. [+] File checksum calculator. This is a new tool for creating file checksums, as well as for hashing files to ensure data integrity. The tool uses different hashing algorithms, such as CRC-32, MD5, SHA1, SHA-256, and SHA-512. It can work in a batch mode computing and verifying checksums of multiple files of any requested directory. [+] Duplicate file finder. If you have thousands of music files, documents, photos or videos and you are running out of disk space, this tool is right for you. It will help you to locate and remove useless file duplicates, empty files or folders literally, in a couple of mouse-clicks. We tried to make this tool as fast as possible and optimized the file processing speed for SSDs and multi core CPUs. [+] SQLite viewer. This is an extremely simple tool for viewing and analyzing databases in SQLite format. [+] Boot status explorer. This tool keeps track of the boot process and identifies any issues that may occur during boot. The tool parses the bootstat.dat file and extracts boot information stored by Windows Boot Manager, including but not limitted to the previous boot sequence, the last successful boot and any previous failed attempts. This can be vital when you need to determine the cause of any boot failures, such as a crash or unexpected shutdown. If Windows fails to start up properly, the Boot status explorer can be used to determine the cause of the failure and provide guidance on how to resolve the problem. [+] The Windows Search database explorer supports for the newest format of the Windows Search engine used in Windows 11. The Windows 11 Search storage format migrated from ESE to SQLite, has some properties and its logic changed slightly. The current update of our tool can handle both old and new formats now. [+] The backup tool supports new items, including some e-wallets. [+] BitLocker drive decryption has a new option that allows users to get BitLocker recovery keys back from their Microsoft accounts. [*] Out-of-the-box support for some new HDD and SSD drives, including NVMe ones. [*] This update has some minor problems fixed and applies several enhancements in the Network password recovery module. [*] Some general improvements handling user accounts configured for a passwordless sign-in. [*] The module of the personal data extraction from Chrome and Chromium-based Web browsers performs much faster, analyses deeper and fetches more data now. This module is used by the data backup tool. [*] Language update for French, Gujarati, Hungarian, Hindi, Brazilian Portuguese and Russian interfaces. [!] The previous version sometimes failed to decrypt DPAPI credentials instantly using Windows Hello saved biometrics. This version has a fix for the problem of the instant data decryption using Windows Hello facial or fingerprint biometrics (without providing password or pin). [!] The previous version had a severe error backing up wireless network profiles, passwords of Microsoft accounts, and Azure AD credentials for some machines. Version 12.3.1 [+] Volume Explorer. This is a new tool to mount hidden partitions of a drive. [+] A new tool to parse and view databases in an ESE (Extensible Storage Engine) format. [+] Windows Search database explorer. The world's first human- readable viewer for Windows Search index. [+] Plaintext password recovery now got a new option to fetch words from Windows Search database. It works when searching domain credentials, document passwords, PINs, SYSKEYs, Virtual PC, local and domain passwords. [+] The About dialog shows a power indicator now. Helpful to check if you're not running out of power on a laptop, for example. [*] The ESE database reader now uses a better database size auto- detection algorithm. The ESE reader is used by SCRUM, Windows Search, Windows Edge history parser and in other tools. [*] ESE databases copied from another PC have a 'dirty shutdown' flag set on. If the OS was not shut down properly or even was not shut down at all, most system databases such as Windows Search or System Resource Usage Monitor, are marked as 'dirty'. It means that some data still reside in transaction log files and it is required to complete the transactions in order to open the database. When parsing an ESE database, the program now checks if it has the 'dirty shutdown' state and, if yes, prompts for auto-repairing. [*] Some visual improvements. [*] Update for Brazilian, Hindi, Hungarian, Gujarati and Russian language interfaces. [*] The forensic backup tool can collect additional items now: Microsoft Edge history, Windows music and video databases, Microsoft communication database, Windows error reports and user crash dumps, Power efficiency reports, SMS message store. [!] The file backup tool was not functioning properly and created a ZIP archive with duplicate items sometimes. [!] Some interface issues. Version 12.2.0 [+] System Resource Usage Monitor. [+] The password backup tool supports some additional private items: discord, filezilla, total commander, pidgin, psi, Nord VPN, Proton VPN, Open VPN, crypto wallets, such as Electrum, Ethereum, Exodus, Bytecoin, BitcoinCore, DashCore, Monero, LitecoinCore, and some other stuff as well. [+] Windows search database backup. [+] Wireless passwords search. [+] A new tool for mapping network drives. [*] Update of the Hindi, Hungarian, Gujarati, and Russian language interfaces. [*] Up to 50% speedup processing files and folders Version 12.1.0 [+] Recycle Bin history. This feature scans every hard drive and extracts all deleted elements of every found Recycle Bin for every user account. [+] USB history displays the list of storage devices that were connected to the computer earlier, their sizes, serials, as well as some other technical information. [+] The data backup tool now supports handling events and system resource monitor logs. [+] Dump Windows PIN. A new tool for saving Windows PINs to text files. [+] Support for Azure AD accounts. [+] Instant password recovery for some user accounts. To be more precise, all ones that have biometric logon and no TPM protection. The new feature works, for example, in network credentials recovery. [*] DPAPI decryption module was revised and updated significantly. Now it has a full-scale support for Microsoft and Azure AD accounts, works with password-less accounts, includes some improvements in ARSO submodule (one that allows decrypting data without user password or PIN). [*] Enhanced compatibility with password-less accounts. [*] Update for Chinese user interface. [*] The local user selection dialog has been revised slightly. Now it displays the last logon time, supports for Kiosk and AzureAD users (aka work or school) accounts, etc. [*] A number of minor improvements. [!] A hangout error creating an *.E01 image of a physical disk. Version 12.0.0 [+] Windows media forensic. This is a new set of tools for analyzing pictures and videos stored in Windows Photo database. This set includes: - Photos - a general report with all found images and their properties. Such as size, date taken, location, caption, source device and properties, etc. - Photo faces - a list of detected faces - Photo persons - a list of faces grouped by persons - Photo tags - a list of detected objects ranged by tags - Photo OCR - recognized characters and words - Photo locations - locations where photos were takes - Photo dates - dates when photos were takes - Camera models - images grouped by camera model - Camera manufacture - images grouped by camera manufacture - Multimedia applications - software that were used for editing - Photo albums - a list of photo albums - Video - a general report with found video items and their properties. Such as size, date produced, duration, caption, copyright, etc. - Video faces - a list of detected faces in video files - Video persons - a list of faces grouped by persons - Video tags - a list of detected objects in video files, ranged by tags - Video dates - dates when video files were produced - Video albums - a list of video albums - Album views - album view statistics - File views - media view statistics - Imports - a history of media import actions - Searches - a history of search queries in media database - Shared items - media files shared by user - Print history - media files printed by user [+] Search for passwords stored in images. The Artificial Intelligence attack can now use the optical character recognition module to extract words from images stored in Windows Photo database. If a user used Windows Photo to save some passwords as a picture or as a screenshot previously, the program can extract the textual password from the image and use it for further recovery. It's proved to be working quite efficiently on multiple real- life cases when decrypting local and domain passwords, domain cached credentials, encrypted documents, Windows Hello PINs, etc. [+] New themed interface, redesigned main dialog, a lot of minor improvements. [+] Hungarian language interface. Updates for French, Gujarati, Hindi, Italian, Spanish and Russian interfaces. [!] A minor bug in the rollback dialog. Version 11.4.0 [+] Windows activity timeline. [+] The password and private data backup tool supports Windows activity timeline now. [+] Clipboard history. This tool extracts and decrypts text, pictures, and other data stored by Windows clipboard. The Windows clipboard is cleared out every time the user logs off the system. However, if the clipboard history option is on, the system preserves and saves the clipboard. Thus, the data can be easily extracted and decrypted even after the system shutdown. This is what this new tool is for. The program supports the Windows shared clipboard, the clipboard history and clipboard sync data. [+] The Artificial Intelligence attack has got a new clipboard analysis module. The attack searches for any saved words, passwords, and text inside the clipboard of every local and domain users. Then it mixes up and varies the found words to get a list of password candidates and at last uses the password candidates to check the plaintext password user needs to guess. This feature works when searching for the following items: - Local and domain users' passwords - Domain cached credentials - Plaintext passwords of encrypted documents - Windows Hello PIN - Syskey password - Passwords for encrypted virtual OSes [*] Some interface enhancement. All program's dialogs are resizable now. [!] Sometimes running a custom recovery (a dictionary, hybrid or mask attack) caused the program to fail unexpectedly. Version 11.3.0 [+] Support for Windows 11 and Windows Server 2022. [+] Sticky notes extraction tool. This is a new feature for displaying sticky notes stored (and even some deleted ones) in Windows 7-11 OSes. [+] A new forensic investigation feature for detecting camera and microphone access tracking. It detects what program was using hardware, when and how long was the last session. [*] Some visual enhancements. Version 11.2.0 [*] The backup tool got Unix and Mac filename compatibility now. Version 11.1.1 [*] Updates for the French, Hindi, Gujarati, and Russian user interfaces. Version 11.1.0 [+] Searching for backdoor passwords when recovering Microsoft Office documents. [*] Better UI response timings when searching for application keys. It took too much time sometimes to stop the keys extraction process. [*] Updates for the French, and Russian interfaces. [*] Performance optimization when recovering Windows PINs. Up to 8-x speedup for CPUs with AVX2 instruction set. [*] Significant performance optimization when recovering Domain Cached Credentials type 2. Up to 20-x boost on newer CPUs. [*] Performance optimization when recovering VMWare and VirtualBox encrypted machines. Up to 7-x boost for VirtualBox and up to 2-x speed increase when recovering VMWare encrypted virtual PCs. [*] Support for disks with non-default sector size when creating disk images. [!] A serious error loading some old-style Microsoft PowerPoint and Word documents. [!] Error parsing most open document formats. The program failed to decrypt some OpenOffice documents because of the bug. [!] The Windows Events tool didn't work for the newest versions of Windows 10. [!] Occasionally some Opera profiles were skipping in the Browser history tool. Version 11.0.0 [+] Support for Windows 21H2. [+] Password recovery for Indian Aadhaar and e-pan cards. The Aadhaar card is a pdf file that contains an unique Identification Authority of Indian citizen (https://en.wikipedia.org/wiki/Aadhaar). The e-pan card is a digital identifier issued by the Indian Income Tax Department. This version of the program has out-of-the-box support for both PDF types. To recover an Aadhaar/e-pan card, select the tool for decrypting passwords of the recently used documents, right-click the list of found items, uncheck any other files for a faster password search and run the appropriate recovery. To decrypt the electronic PDF cards RWP automatically involves 7 different attack types that allow keeping the success rate close to 100%. [+] Syntax of the mask attack supports setting dictionaries now. Password recovery using the mask attack has become much easier. For example, if you know that the password you search for consists of a word along with a number at the end, you can set the following mask: %w(English.pcd)%d(1-5) This mask checks all words from the built-in English.pcd dictionary adding numbers from 0 to 99999 at the end of every word. [+] Spanish manual and help. [+] Support for Encase format *.E01 when creating drive images. [+] Support for Windows hibernation state. If one of the program's features requires requests a disk write access and the program detects that the target Operating System is in a hibernating state, it displays a warning message and prompts to reset the hibernation to avoid some synchronization problems. [+] An enhanced algorithm for extracting user account pictures has been applied. [+] Windows directory selection dialog now shows a piece of additional and helpful information (depending on working mode) about user accounts, last logon time, last logged on user, Windows Hello protection type, etc. [+] The user selection dialog displays the last sign-in method (for a local account). [+] The user selection dialog can be used now to view Documents, Downloads or Desktop folders of the local account. [+] The backup tool got a new option to search and save memory dumps and hibernation files. Those files can be used later to extract user hashes, logon passwords, web credentials, disk encryption keys, etc. [+] The backup tool can extract and save Windows Sticky notes as well as media databases. [+] A new option for protecting archives with a password when creating backups of the passwords and personal data. [+] The Windows Sticky notes wordlist extractor is included in AI recovery module now. The AI password recovery is used when recovering plaintext passwords for Windows accounts, document passwords, Windows PINs, Windows Syskey, passwords for virtual disks, etc. [+] OS information module (included in some dialogs) now decrypts and displays instantly Windows product keys, whenever it is possible. The keys can be extracted from the local registry or from the BIOS of the target computer. [+] Intelligent PIN recovery. Every time a user tries to decrypt Windows PIN, the program analyses all found PINs and, if some weak ones are found, offers an intelligent recovery. First, the guaranteed recovery for the PINs that can be found in the fastest possible way is launched, then go time-consumptive ones, and at last, those that can be recovered applying a frequently used patterns lookup. A user is free to switch between the intelligent and a common recovery, however. [*] The built-in English dictionary was updated with some commonly used and popular passwords were added. [*] The last logged-on user is highlighted wherever it's possible now. [*] Users can launch the secret questions and answers dialog directly. Previous versions of the program did it automatically. [*] Updates for French, Hindi, Italian, Russian and Spanish interfaces. [*] The program's smart logic has been improved. For example, once started, the Reset Windows Password searches for memory dumps, BitLocker protected drives, virtual machines, etc. and, if one of the items is found, offers to back up the dump files, unprotect the BitLocker drives or mount the virtual machine. Another example is smart password recovery. Instead of brute- forcing passwords recklessly, RWP has a totally different approach. When it is not possible to decrypt a hash instantly, the program tries to collect as many passwords and words out of the target system as possible. All kinds of potential passwords are extracted including local and network credentials, e-mail correspondence and attachments, browser search histiry, Windows sticky notes, recently used files, and so on. Once collected those words are used to create a list of password candidates based on numerous rules of social engineering. The third example of smart behavior is the recovery/reset process itself. Before applying any critical operation, like resetting a password, the program figures out if the appropriate plaintext password can be extracted instead by applying any known method or a backdoor. For example, extracting passwords from LSA secrets or autologon information, analyzing passwords hints and secret questions, using biometric databases and TBAL secrets, decrypting network credentials and so on. [*] OS information module displays a bit more correct data about Windows version and build number. [*] Some interface improvements. [*] A little bit more proper Microsoft Edge and Opera detection when recovering browser passwords. [!] Item reusing fix. It caused a speed degradation when recovering passwords for encrypted documents, domain cached credentials, and virtual disks. [!] Security issue. [!] A problem decrypting Internet Explorer 7-9 autoform data was fixed. [!] An error searching for folders with recently-used files. It occurred on international versions of Windows only. [!] Files larger than 4.3 GB were processing incorrectly in password backup and image creation tools. [!] Json parser bug. The problem caused the program to fail unexpectedly sometimes. [!] Microsoft Edge browser passwords were not decrypting properly in certain cases. The program skipped some vital items when backing up Edge files. [!] PIN recovery using custom attacks worked incorrectly in certain cases. Version 10.5.0 [+] Interface and system restriction policy editor. This is a tool for offline handling different system restrictions. For example, lock/unlock Control Panel setting, enable/disable Task Manager or Run dialog box, allow/disallow access to the Command-Line or the Windows Registry, restrict certain Windows applications to be run, grant or deny access to storage devices, etc. [*] File compression speed has been optimized significantly. The ZIP compression engine is used by the following utilities: the password backup tool, the recently used files finder, the tool to search for encrypted documents. [!] On some systems, the Windows Hello credentials were detecting incorrectly by the password backup tool. Which was causing the Windows Hello encryption keys to skip when saving passwords and sensitive information. Version 10.4.1 [+] Support for Windows 10 21H1. [+] Support for old Microsoft Office 97-2003 formats when searching document passwords. [*] Some enhancement enumerating and processing *.json files when searching for plaintext passwords. [*] Speed improvement processing zip files. Unpacking a big *.zip file now takes significantly less time. [!] Fixed a memory overusage problem processing huge *.xlsx files. Version 10.3.0 [+] Disk images creation. Using the program's simple 3-step interface, it's now easy to clone a logical disk or make an image of the whole physical disk or a certain partition. [+] Windows PIN history decryption. You can use the Logon policy editor to turn on/off the PIN history in Windows 10. [*] Support for 7z archives when parsing email attachments, searching for passwords in recently used files, running Artificial Intelligence attack, etc. [*] A brand-new HTML/email parsing engine that was rebuilt from scratch with a more thorough data and word analysis in mind. The main advantages of the new engine are: - Faster processing of plain HTML files; - Better detection of text encoding; - Much deeper processing of email attachments. For example, if the program finds an attachment as a ZIP file, it unpacks the content of the archive, enumerates the files, and extracts words from every file to put them into a general wordlist (to be used later for password guessing). If the ZIP file in the attachment is password-protected, the program first tries all previously found credentials to guess the password for the archive; The HTML/email parsing engine is aimed mostly to generate the user vocabulary. For example, when extracting user email correspondence, recently used files, typed-in words in browser search, etc. This vocabulary is used then for guessing plaintext passwords. [*] Now the program can display last modification date for extracted Windows Hello credentials, plaintext PINs, PIN history, Picture Passwords, etc. [*] Interface enhancements. [*] Updates for the Chinese, French, Gujarati, Hindi and Russian interfaces. Version 10.2.0 [+] A new tool for searching and exploring Windows files that have been opened recently. [+] Program execution timeline. This is a new tool for displaying the timeline of which program was executed and when. [*] Some interface improvements. Version 10.1.0 [+] Password policy editor got two new options: - Enable/disable storing LM hashes of the account passwords - Blank passwords usage restrictions [+] Password reports contain some additional information now: OS, install date, last logged on user, installed browsers, etc. [*] Chinese interface has been updated. [*] Some enhancements in the password backup tool. [*] The algorithm for caching decrypted master keys has got some improvements (when decrypting browser, network, or mail credentials). [!] An incorrect wipe-out of some lockout policy flags was fixed when resetting a password of a local account. [!] A problem displaying a report of the last modified documents has been fixed. [!] A security issue. [!] SYSKEY password was not displaying sometimes after a successful recovery. Version 10.0.0 [+] Password recovery for encrypted documents: Microsoft Word, Excel, Access, PowePoint, OneNote, OpenOffice, LibreOffice, MyOffice, PDF. [+] BitLocker key recovery and extraction from Active Directory. [+] New Gujarati and Hindi language interfaces. [*] Update for French, Italian, Russian and Spanish languages. [*] Polish translation for the logon policy options tool. [*] Some visual enhancements. [!] A problem decrypting some old-style Firefox/Mozilla passwords. [!] A buffer overflow error decrypting domain DPAPI masterkeys has been fixed. [!] Some interface bugs in the rollback dialog have been eliminated. Version 9.9.0 [+] Support for Windows 10 20H2. [+] Support for passwordless sign-in option of the latest version of Windows. [+] Logon policy settings editor. [*] New items were added to the password backup tool. [*] Now you can shut down your computer (instead of restarting it). Just hold down the Shift key when exiting the program. [*] Enhancements support when extracting passwords out of the following Chromium-based browsers: 360 Safe Browser, 7Star, Amigo, Brave, Centbrowser, Chedot, Canary, Coccoc, Comodo Dragon, Elements, Kometa, Orbitum, QQ Browser, Sputnik, Torch, UC Browser, Uran, Vivaldi. [*] Some enhancements running file explorer using the default configuration. [*] The algorithm for extracting and decrypting Windows Hello credentials was improved a bit. [*] French, Italian, Portuguese, Spanish and Russian interfaces have been updated. [*] Support for Chinese language. [!] A guaranteed PIN recovery was not started (in PIN lookup dialog) if a custom attack was selected. [!] The program was unable to decrypt passwords for some Vault items when searching for network passwords. Version 9.8.0 [+] VNC password recovery. [+] Password recovery for Tortoise SVN accounts. [+] Password recovery for Open VPN accounts. [+] Searching for password stored in script and batch files on the local PC. [+] RWP access password. Now you can protect your RWP bootable drive with a startup password to prevent other people from being running the program and viewing your personal data. [+] Brazilian Portuguese language interface. [*] Out-of-the-box support for some new HDD/SSD devices. [*] Enhanced algorithm for unlocking BitLocker-encrypted drives. [*] Enhanced algorithm for finding and decoding group policy passwords. [*] Some improvements in the algorithm that is used by the program to roll back changes for a local PC. [!] Some problems detecting, processing, and resetting lockout flags were fixed. For both local and domain accounts. [!] A bug has been fixed searching SAM/AD plaintext passwords using Artificial Intelligence. Version 9.7.0 [+] Support for Windows 10 2004. [+] Password recovery for VmWare and VirtualBox virtual machines. [+] Display additional info about target operating system when choosing registry files. [+] Account lockout policy check. Now when resetting a password the program additionally checks if the user account is locked by lockout policy and, if yes, prompt to reset the policy as well. [+] Support for Lockwise password encryption when extracting passwords out of Mozilla-based applications like Firefox, SeaMonkey, K-Meleon, etc. The Lockwise password manager (on desktop, this is a part of Firefox v70+) has got new and enhanced protection based on AES-256 cipher and SHA-256 hashing algorithms. [+] Italian interface language. [*] Update for Chinese, French and Russian interface languages. [!] Sometimes the program was unable to find and extract pictures for local user accounts. Version 9.6.0 [+] The program has got support for custom recovery when decrypting SAM and NTDS.DIT hashes, domain cached credentials, Syskey and Windows PIN. The customization includes three general methods so far: Dictionary, Hybrid and Mask attack. [+] Support for a new type of password encryption that was introduced in Google Chrome v80 as well as in other Chromium browsers. New version of the Google Chrome encrypts passwords using AES-256-GCM algorithm and a system-generated 32-byte random key protected with DPAPI. [*] Some enhancements in algorithm for extracting passwords of Chromium-based browsers like Google Chrome, Opera, etc. The thing is that all private data in those browsers are encrypted using DPAPI which requires logon credentials. Thus, providing logon password is necessary to decrypt the browser data. However in certain cases, the program can decrypt the data without logon credentials. The new (optional) algorithm, even though became a bit slower, provides a more efficient and automated way of doing it. [*] Update for French and Russian interface languages. Version 9.5.0 [+] Support for Windows 10 1909. [+] Now it is much easier to recover lost passwords and personal data even on virtual OSes. The program automatically scans the target PC for virtual OSes installed locally and prompts to mount ones if found. Currently, the automatic detection and mounting are supported for VMWare guest OSes only. [+] New Polish interface. [*] The mass storage driver pack has been updated. Some new drivers were added. [*] Updates for French and Russian interfaces. [!] Sometimes when searching for plaintext passwords, the program cut found LM passwords to 6 characters. Version 9.4.0 [+] Passcape tables recovery was superseded with a brand-new attack that uses deep learning algorithms for guessing plaintext passwords. Even though in most cases it works slower than Passcape tables, the number of passwords it can guess is significantly higher. [*] Several enhancements and some new features when extracting recent user activity information. [!] Some columns in the list of found items (in the document search dialog) were not sorting properly. [!] The progress was not showing properly while backing up the list of found documents. [!] An error decrypting some DPAPI master keys for domain users was fixed. [!] A minor problem detecting Windows XP system directory has been eliminated. Version 9.3.0 [+] Support for Windows 10 1903. [+] Support for Trusted Boot Auto-Logon. [+] Microsoft Edge Dev (based on Chromium code) is supported now when recovering network/browser passwords. [*] Some changes in the algorithm of decrypting browser, mail, and network credentials. A minor speedup when processing a big list of found passwords. Other enhancements. [*] Support for new data storage when decrypting secret questions and answers for Windows 10 accounts. [*] Some useful enhancements were added to the password backup tool. Version 9.2.1 [*] Language updates. Version 9.2.0 [+] Web history. The program can now extract and decrypt URL history, form autocompletion data, logins, passwords, cookies, and other information stored by popular browsers: Internet Explorer, Microsoft Edge, Opera, browsers based on Mozilla code (Firefox, SeaMonkey, PaleMoon, etc.), Chromium- based ones (Google Chrome, YandexBrowser, 360 Extreme Explorer, etc.). [*] Updates for French, Spanish and Russian interfaces. Version 9.1.0 [+] Spanish interface. [+] New tool for viewing system events. [*] Better discovery of some email passwords. Version 9.0.1 [*] Some enhancements when recovering Internet Explorer 10-11 passwords. [+] Support for Firefox v58+ (as well as other Mozilla-based applications) when decrypting browser passwords. [*] Minor interface improvements. [*] Update for French manual. Version 9.0.0 [+] Support for Windows 10 RS5. [+] Support for Windows Server 2019. [+] Account statistics viewer. [+] Hardware history view. [+] Software installations view. [+] Network history viewer. [+] Recent user activity viewer tool. [+] New tools to view last modified files and folders. [+] The program can now extract and view new Windows 10 secret questions and answers. [*] Translations for German, Russian and French interfaces have been updated. [*] Some minor enhancements. [!] Product keys search was not working properly. The program was skipping some found keys. [!] Domain cached credentials resetting was not working properly on some Windows configurations. Version 8.4.2 [*] The program now uses a little bit smarter way to decrypt browser passwords. [!] Error enumerating some Windows Vault entries. [!] Multiple memory leaks. Version 8.4.1 [+] Support for Windows 10 biometric credentials. Once the program detects biometric credentials, it can use them to decrypt logon passwords of the user account. [+] New tool for searching and unprotecting logon credentials stored by Windows Hello. [+] New PIN recovery tool. [*] Support for Windows 10 Spring Creators Update. [*] Virtio drivers were added to the program's driver package. [*] Update for French manual and program's interface. [*] Some minor changes in Bitlocker-drive decryption dialog. [*] Some improvements. Version 8.3.0 [+] Password policy editor. Both local and domain versions. [+] Full French help. New manual in French language is available now if French interface is selected within the program. [*] A minor fix was implemented dumping hashes to pwdump format. For really stupid programs that accept hash lines with the ':' trailing character only. [*] Password reset dialog now shows whether new password conforms to password policy (if one is set) of the target PC or not. [*] Update for French language interface. [!] The feature for wiping out Windows password reset information was not working properly for some OSes. Version 8.2.0 [+] Native support for Bitlocker encrypted drives. Version 8.1.0 [+] Support for Windows 10 Fall Creators Update. Version 8.0.0 [+] New tool to reset passwords of domain cached credentials. [+] New tool to search for domain cached passwords. [+] This version also allows rolling back changes made to domain cache. [*] New program's logic. Now all tools are scattered across 4 working modes. The working modes are: SAM - regular user accounts DCC - domain cached accounts AD - Active Directory domain accounts UTILS - miscellaneous utilities [*] The program migrated to new WinPE environment. [*] New set of HDD drivers that come with the program. [*] Support for multithreading when recovering SYSKEY plaintext password. Password search speed was increased up to several times (depending on CPU used). [*] Update for French and Russian language interfaces. Version 7.2.0 [+] New tool for searching password-protected documents. [*] Some improvements. Version 7.1.0 [+] Croatian language interface. [+] New feature for creating SAM user accounts. [*] Support for Windows 10 Creators Update. [*] Several improvements in multilingual interface. [*] New file explorer tool. [!] Error processing tables attack. Some found passwords could be skipped. Fixed. [!] Some workaround to prevent the program from being frozen for a while after stopping a password search attack. Version 7.0.5 [+] Password recovery for popular Internet browsers: Internet Explorer, Edge, Chrome, Firefox, Opera, Safari, etc. [+] New feature to recover account passwords for popular e-mail clients. [+] New feature to search and recover network passwords: LAN, WAN, RAS, DSL, VPN, WiFi, etc. [+] New file manager based on GUI interface. [+] Russian help-file. [*] Deep code reorganization, enhanced protection. [*] Update for French and Russian language interfaces. [!] Fixed a bug decrypting some passwords for HomeGroupUser$ user accounts. Version 6.5.0 [+] Support for Windows Server 2016. [+] New HDD drivers were added to the program's package. [*] Plaintext password detection algorithm was enhanced slightly. [*] Update for French and Russian interfaces. [!] Fixed a error extracting Active Directory plaintext passwords. [!] Fixed some troubles zeroing out SYSKEY. [!] Fixed a bug encrypting/decrypting some hashes in Windows 10 Anniversary Update. Version 6.4.0 [+] Support for a brand-new encryption scheme of protecting password hashes in SAM file. The new protection came with Windows 10 Anniversary Update. The update affects almost a half of program's features like logon password reset/ recovery, SYSKEY lookup/delete, hash dump, etc. [+] Support for native AES-NI CPU instructions for faster SYSKEY password recovery on modern PCs. [*] This version can also utilize a discovered vulnerability in new protection scheme (set by Win 10 Anniversary Update). This simple flaw helps to run SYSKEY password recovery a little bit faster. [*] Some changes in SYSKEY reset mode. Version 6.3.1 [*] Update for French language interface. [*] Minor interface improvements. Version 6.3.0 [+] Support for Windows Server 2016 TP5. [+] New password backup feature. It allows users to backup easily Windows registry, Active Directory and other sensitive data like network/mail/internet passwords, certificates, etc. The feature is available freely in all editions including demo version. [*] More accurate name extraction when dumping hashes for Microsoft LiveID accounts. [!] Fixed a critical problem when displaying a folder browsing dialog. Version 6.1.0 [+] Support for Windows Server 2016 TP4. [+] New fingerprint attack to search for syskey and logon passwords better. [+] New modules for extracting AD sensitive information like UNIX-compatibe passwords, script execution passwords, etc. [*] Support for high capacity disks (over 32 Gb) when formatting RWP bootable drives to FAT32. [*] RWP ISO image has been reconstructed to get better compatibility with UEFI motherboards. [*] Support for Radius password decryption when importing Active Directory accounts. [!] Fixed some UEFI compatibility problems. [!] A minor problem resetting AD passwords was fixed. [!] Serious error in Active Directory password extraction module. The program might stall or fail unexpectedly. Fixed now. [!] Fixed a bug in ISO Burner utility. 'FAT32 MBR BIOS' partition mode worked incorrectly for some USB devices. Version 6.0.0 [+] New boot image environment (based on Windows 8.1). [+] New set of Win 8 compatible drivers. [+] USB boot module of the ISO burner utility has been rewritten. Now it has several burning modes to get better BIOS and UEFI compatibility. The 'max compatibility' mode allows creating USBs that can be run under BIOS and UEFI simultaneously. [+] Dictionary recovery (when searching for user logon passwords and SYSKEY plaintext password) has been rewritten completely. Now it performs a bit smarter and uses brand-new dictionaries that hold top passwords for the following languages (Standard and Advanced editions only): Arabic, Chinese, English, French, German, Portuguese, Russian, Spanish. [!] Fixed a problem in a module that searches for simple passwords. Version 5.3.0 [+] Full support for Windows 10. [+] Microsoft Live ID to local account conversion feature. [*] Better guessing plaintext passwords based on keyboard combinations. [*] French and Russian translation updates. [!] Fixed a memory error decrypting plaintext passwords on some machines which caused a fatal crash. [!] Some minor fixups. Version 5.1.5 [!] Fixed a serious error in password reset dialog which caused the program hung or crashed. [!] Minor multilingual interface bug in startup dialog. Version 5.1.3 [+] New feature for looking up lost product keys. [+] The program now correctly processes 'Account expire date' and 'Logon hours' flags and resets them if needed. This additional checkout is applied for both SAM and Active Directory accounts. [+] New icons and some visual enhancements. [*] Several default setting were changed in password lookup dialogs. [*] Some annoying warnings were suppressed when parsing Active Directory databases. [*] Minor improvements. [*] Update for French and Russian interfaces. [!] Fixed a critical error parsing Outlook Express entries. The bug affected some password lookup modules. Version 5.0.0 [+] Support for UEFI-based PCs. [+] Support for Windows 10 Technical Preview. [+] New feature for changing account flags and properties. [+] A lot of new IDE/SATA/SCSI drivers were added to the program's package. [*] The program migrated to 64-bit environment. [*] Many enhancements in LM password recovery engine. More sophisticated password guessing of LM hashes. [*] Some changes in (plain-text) password search engine. [!] Fixed a problem parsing some Active Directory accounts. Version 4.2.0 [+] SYSKEY password lookup feature. Now you can search for SYSKEY startup passwords. [+] New password extraction module has beed added for instant recovery of some sensitive information in a domain. For example, the following plaintext passwords of a domain user are decrypted instantly now: Web site passwords in Internet Explorer 10-11, Google Chrome, Opera Browser, LAN passwords, etc. [!] Fixed a password search error in sector-based disk indexing tool. Some NTLM passwords may be skipped by the program. [!] Fixed a critical error in password search engine. Dictionary attack was not working properly sometimes. Version 4.1.3 [+] Sector-based disk indexing tool. The program can now search for passwords by indexing and analysing raw sectors of the selected drive. [*] Several enhancements in password lookup module. [*] Hiberfil.sys/pagefile.sys parsing module has been rewritten. The program can extract more passwords now. [!] Some damaged ntds.dit files may caused the program to enter a endless loop when importing hashes. Fixed now. [!] Fixed a critical error parsing Outlook *.pst files. The program may failed unexpectedly when looking up for passwords. [!] Critical bug was fixed. The program failed sometimes when searching for passwords. Version 4.0.0 [+] Thai language interface. [+] Added Russian dictionary. [+] Added a brand-new 20 Mb English wordlist. [+] 3 new password search modules to search passwords in recycle bin, in big files and in hiberfil.sys. [+] File manager. [+] Support for password search in Microsoft Office, OpenOffice and LibreOffice documents. [+] Support for seach-terms extraction of almost all Chromium-based browsers: Google Chrome, Orbitum, Torch, CoolNovo, Comodo Dragon, RockMeIt, SRWare Iron, Yandex browser, Epic browser, etc. [+] Skype chat analysis. [+] Support for password search in Internet Explorer 10-11 cache. [+] Manual password check (in password lookup dialog). [+] Virtual disk mounting tool. [+] New password recovery module to recover group policy plaintext credentials in a domain. [*] All dictionaries are supplied in PCD format now to shrink the program's size. [*] Great speed improvement in password search engine when checking a big list of hashes. [*] Almost 50% of password search code has been rewritten. [*] A lot of minor improvements. [*] Changed the way of detection some system files and folders. [!] Fixed some language selection and switching problems. [!] Fixed some memory-related problems in password lookup modules. Version 3.1.4 [+] French language interface [*] Some multilanguage interface enhancements [!] Word analysis of the recently used files (in password lookup module) took quite a long time, so the program failed into endless loop sometimes. Fixed now. Version 3.0.0 [+] Support for Windows Server 2012 [+] Full support for Active Directory passwords that are stored using reversible encryption. The program can now instantly extract and decrypt the reversibly encrypted passwords using both password encryption methods: prior and after Windows 2K3. [+] Added support for Diskpart and Chkdsk utilities. [+] Network support. [+] Keyboard layout support. Now you can load any keyboar layout and use Alt+Shift combination to switch between them. [+] New plaintext password recovery sub-module: most recently used file parser. [*] Enhanced compatibility for specific Windows 2008 R2 domain accounts. Sometimes even if the account password was changed, Windows did not recognize new password. Fixed now. [*] Several changes in Active Directory engine parser. [*] More accurate handling of corrupted Active Directory databases. Version 2.2.6 [!] The program did not reset account flags properly if non-English interface was chosen. English version works as expected. Version 2.2.4 [+] The program is fully compatible with Windows 8, supports new LiveID accounts now. [+] New plain-text password recovery module for Windows 8 has been implemented. It allows to extract text passwords for all user accounts with picture password or PIN authentication. [+] Now the program can extract user plaintext passwords for accounts with fingerprint logon. UPEK and Windows biometric records are supported. [+] French language interface added. [*] RWP bootable disk contains no "Press any key to boot from .." prompt any more. The disk starts automatically. [*] Storage driver pack has been updated to support new hardware. [*] A lot of changes in DPAPI offline recovery module to make it compatible with Windows 8. [*] Password lookup algorithm was enhanced slightly. [!] Some HomeGroup account passwords were decoded improperly in Windows 8. Fixed. Version 2.1.0 [+] HomeGroup account password decryption [+] Windows Vista/7/8 WPA-PSK password decryption [!] Artificcial Intelligence failed sometimes with critical error [!] Error in password reset algorithm. Version 2.0.0 [+] Windows 8 RC compatibility. [+] New recovery module using Passcape Rainbow tables. The program can decrypt more password now. [+] Added support for multiple keyboard layouts in password lookup module. [+] Hebrew user interface [*] More accurate code handling in Active Directory password reset module. [*] Password lookup module has been rewritten from scratch. [!] Artificcial Intelligence attack minor bug. Version 1.4.7 [+] Chinese user interface [+] Persian user interface [+] Added new HDD drivers [*] Program's help resides in chm file now [*] Get rid of some unnecessary stuff [*] The program was rebuild under new PE environment [*] Improvements for Active Directory reader engine. Some NTDS.DIT files (taken from Windows 2008 R2) were not handled properly by the program. Version 1.2.0 [+] SYSKEY reset Version 1.1.3 [!] Fixed several errors in password lookup module, It has been improved a bit as well. Version 1.1.2 [!] Fixed Windows x64 bit problem in registry parser [!] Fixed stack overflow bug in PPP MIME parser module [!] Password lookup algorithm has been improved slightly Version 1.1.0 [+] English dictionary extended up to 4 Mb. It contains top 500 frequently used passwords now. [+] Demo version can dump Active Directory hashes and domain cached credentials now [!] Some improvements and fixes in Artificial Intelligence attack [!] Numerous bugs fixed in cache dump module [!] Fixed *.puc problem when all subsequent file-write sessions ovewrote previous ones [!] Security issue Version 1.0.3 [+] First public release =====================================================================