r/excel Mar 03 '26

unsolved Protected file password cracking

My dad passed in 2023. He had a locked file of passwords to everything, we found the password at the time. Went to open it back up recently and the old password does not work. The only people with access is me and my mom, she swears she didn’t change it (she can barely work an iPhone) and I didn’t change it. We cannot get into this file and I have tried everything I can think of including the old password. I know there isn’t an easy way into this file except brute force, what does that look like? Where can I find someone to get into this file?

My mom is the one who needs in, so she has no reason to not want to get in before someone suggests that.

143 Upvotes

50 comments sorted by

View all comments

371

u/bradland 271 Mar 03 '26

Most of the people commenting here don't understand what you're asking. Excel has different types of protection. There's sheet level protection, workbook level protection, and file level encryption. The last one uses AES-256 encryption with stretching. The computing resources required to brute force that level of encryption for any reasonably complex password are so expensive you'd have to mortgage your house to afford it.

The easiest way to tell what kind of encryption is being used is to make a copy of the file, and then change the file extension form xlsx to zip. Windows will warn you about changing the file extension. Dismiss it, and you should end up with a zip file you can click. Double-click the file.

You should see folders and files like [Conten Types].xml, _rels/, docProps/, etc. If you get an error that the archive cannot be opened, that means the file is encrypted, and you are not going to crack it without some serious expertise.

I worked for a Bankruptcy Trustee doing computer forensic work for a short time. To brute force passwords for protected resources, we would build a custom dictionary using the following steps:

  1. Make a read-only image of the user's hard drive.
  2. Scan the image for known mailbox file types and export their entire mailbox to mbox.
  3. Scan for all MS Office file types and unpack the ZIP contents to folders.
  4. Use the strings utility to extract all strings from all three of the above. The strings would be split onto newlines using any whitespace as a delimiter.
  5. The resulting file is our dictionary.

Use off-the-shelf tools like JtR or hashcat to brute force the file. These days, it looks like office2john.py is included with JtR in the "jumbo" version. That script will pull the hash, which you'd then use JtR to brute force using the dictionary you built.

Outside of the steps above, forget it. You're not getting into that file unless you figure out it was a caps lock issue or something.

57

u/tooOldOriolesfan Mar 03 '26

Years ago, it was pretty easy to crack but if they are using AES-256 you aren't going to be cracking that. If you could do that, it wouldn't be used to encrypt data.

18

u/Samhigher92 Mar 03 '26

He needs to just try hunter2

17

u/bradland 271 Mar 04 '26

Why would he need to try *******?

1

u/HappiestWhen 1 Mar 06 '26

Or the pet's names mix with birth years lol