Data acquired via a GrayKey extraction is outputted into a variety of zip containers (BFU, AFU, Full Files, mem, and a keychain.plist. Magnet AXIOM can then be used for analysis of these files. For investigators, the ideal GrayKey image you want when examining an iOS device is the files.zip. Original text, KeychainDomain-keychain-backup.plist. Original bytes, 4b696e446f6d61696e2d6b696e2d62. Once the device encryption keys have been recovered using the KeyTheft payload, and the device’s filesystem has been recovered using the DataTheft payload, you have everything you need to decrypt passwords stored on the device’s keychain.

WebBrowserPassView v2.11
Copyright (c) 2011 - 2021 Nir Sofer

Description

WebBrowserPassView is a password recovery tool that reveals the passwords stored by the following Web browsers:Internet Explorer (Version 4.0 - 11.0), Mozilla Firefox (All Versions), Google Chrome, Safari, and Opera.This tool can be used to recover your lost/forgotten password of any Website, including popular Web sites, likeFacebook, Yahoo, Google, and GMail, as long as the password is stored by your Web Browser.

After retrieving your lost passwords, you can save them into text/html/csv/xml file, by using the 'Save Selected Items' option (Ctrl+S).

System Requirements And Limitations

This utility works on any version of Windows, starting from Windows 2000, and up to Windows 10, including 64-bit systems.Older versions of Windows (Windows 98/ME) are not supported, because this utility is a Unicode application.
Currently, WebBrowserPassView cannot retrieve passwords from external hard-drive (Except of Firefox Web browser). Support for that might be added in future versions.
On Internet Explorer 7.0-9.0, the passwords are encrypted with the URL of the Web site, so WebBrowserPassView usesthe history file of Internet Explorer to decrypt the passwords. If you clear the history of Internet Explorer, WebBrowserPassViewwon't be able to decrypt the passwords.
On Google Chrome - passwords originally imported from Internet Explorer 7.0-9.0, cannot be decrypted.

Versions History

Version 2.11:
- Added new file type to save the passwords list: 'Firefox import/export csv file'. When you save the passwords in this file type, you can use the import feature of Firefox to import the saved passwords into Firefox: Import login data from a file
- In order to save the passwords as 'Firefox import/export csv file', simply select the items you want to save (or press Ctrl+A to select all passwords), press Ctrl+S (Save Selected Items), choose 'Firefox import/export csv file'from the file type combo-box, type the filename to save and then click the 'Save' button to save the file.
Version 2.10:
- Added support for Brave Web browser.
Version 2.07:
- Fixed to decrypt passwords of Firefox profile that uses both 3DES and AES-256.
Version 2.06:
- Fixed WebBrowserPassView to decrypt the new password encryption on Opera Web browser
Version 2.05:
- Added support for decrypting the encryption key of new Firefox profiles (AES-256 instead of 3DES).
Version 2.00:
- Added support for the new password encryption of Chromium / Chrome Web browsers, starting from version 80.
- Be aware that the 'Local State' file, located inside the 'User Data' folder, is needed for decrypting the passwords of Chrome 80 or later.
Version 1.94:
- Added new file format to export the passwords: Chrome CSV File. It's the same file format that Chrome Web browser exports the passwords from chrome://settings/passwords
Version 1.93:
- Added support for Chromium-Based Edge Web browser.
- The download zip file is now password-protected.
Version 1.92:
- Fixed bug: WebBrowserPassView could crash when decrypting empty passwords in Firefox.
- WebBrowserPassView now automatically detects the Waterfox Web browser.
Version 1.91:
- Fixed bug: WebBrowserPassView crashed when reading Firefox key file (key3.db) without a master key.
Version 1.90:
- Fixed WebBrowserPassView to work with Firefox 64-bit, and also WebBrowserPassView doesn't need anymore the installation of Firefox to decrypt the passwords.This change also fixes a crash problem occurred on some systems.
Version 1.86:
- Added 'Quick Filter' feature (View -> Use Quick Filter or Ctrl+Q). When it's turned on, you can type a string in the text-box added under the toolbar and WebBrowserPassView will instantly filter the passwords table, showing only lines that contain the string you typed.
Version 1.85:
- In 'Advanced Options' window, you can now specify the base profiles folder for Firefox and Chrome (e.g: E:Usersuser1AppDataRoamingMozillaFirefoxProfiles ) and WebBrowserPassViewwill scan all profiles stored under the specified folder.
Version 1.82:
- Added 'Filename' column (For Chrome and Firefox Web browsers).
Version 1.81:
- Added support for Vivaldi Web browser.
Version 1.80:
- Finally.. Fixed a crash problem occurred on some Windows 10 systems (The problem occurred if you added Gmail or other email account into Windows 10 Mail application).Also, WebBrowserPassView now displays the modified time of IE10/IE11 items.
Version 1.75:
- You can now choose the desired encoding (ANSI, UTF-8, UTF-16) to save the csv/xml/text/html files. (Under the Options menu)
- Fixed problem with saving the KeePass csv file.
Version 1.70:
- WebBrowserPassView now automatically detect the passwords of Yandex Web browser.
Version 1.68:
- Another try to fix this mysterious Windows 10 crash problem, also added more debug info to /debugwin10
Version 1.67:
- Made another fix for Windows 10 crash problem..
Version 1.66:
- Made a small change in the password extraction of IE10/IE11/Microsoft Edge that hopefully will solve the crash problems occur on some Windows 10 systems.
- If you have Windows 10 and WebBrowserPassView still crashes, please run WebBrowserPassView with /debugwin10 parameter, run also the DebugView tool of SysInternals, and then send me the last 4 debug lines that appeared before the crash.
Version 1.65:
- Added 'Created Time' and 'Modified Time' columns (These columns are active only for Web browesers that provide this information).
Version 1.60:
- WebBrowserPassView now automatically detects the passwords of Portable Firefox if it's running in the background.
Version 1.58:
- Fixed WebBrowserPassView to display properly user name/password with non-English characters on Chrome Web browser.
Version 1.57:
- WebBrowserPassView now detects the profile folder of Chromium Web browser.
Version 1.56:
- Removed the command-line options that export the passwords to a file from the official version. A version of this tool with full command-line support will be posted on separated Web page.
Version 1.55:
- Added support for Firefox 32 (logins.json).
Version 1.50:
- Updated to work with the latest versions of Opera.
Version 1.46:
- Added secondary sorting support: You can now get a secondary sorting, by holding down the shift key while clicking the column header. Be

See Also

Description

System Requirements And Limitations

Versions History

Decrypt Keychain.plist