Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer


Dumpkeychain is a Windows command-line utility for decrypting credentials from Mac OS X system and user keychains given the associated system-key-file or keychain-password respectively. Mac OS X user keychains often contain many Internet account passwords login credentials and secure notes. The system keychain contains Wi-Fi passwords and other shared credentials.

The application has been tested/developed under Windows 7 using keychain data from Mac OS X 10.8 Mountain Lion and the developers' preview of Mac OS X 10.9 Mavericks. Output is to a user-nominated text file. This version of the application fixes a bug when parsing keychain-tables containing unused record-pointers. It also adds the ability to output the created and last-modified timestamps for each record that has them.

This script was developed for use in EnCase training. For more details, please click the following link:

Download Now

Download Now


Version: 3.1
Tested with:
EnCase Forensic 7.07
Developer: Simon Key
Category: Utility

100 Downloads in last 6 months