Recovering Password-Protected Documents

One of the Help Wanted questions last week was from Beth Comer, who indicated that a financial analyst from her company had died unexpectedly, and that they needed to get into a password-protected document that contained projections on which the analyst had been working.

Most people feel that if you can't get into a document, you are just out of luck. Indeed, some people even questioned the validity of Beth's query. (I guess that those folks somehow think that all financial analysts know when they will die and will, therefore, unlock all their Word documents or write down their password instructions before they go.)

The fact of the matter is, there are valid situations in which getting into a password-protected file is both necessary and ethical. In such situations, your ability to get into a document depends on several factors: the version of document you are trying to open and the vulnerability of the password used.

The Word version used is important because the password protection schemes used by Word have changed over the years. In the first versions of Word (up through Word 6) the protection offered by passwords was minimal, and the documents could be unprotected very easily. Starting with Word 97, however, Microsoft implemented an industrial-strength RC4 encryption algorithm that is much harder to crack.

Actually, the algorithm is essentially impossible to crack, unless you have access to a supercomputer and a couple of friends who work at the NSA. This is where password vulnerability comes into play. People are creatures of habit, and their passwords are no exception. It is not unusual for people to settle on a couple of passwords and use them for all their password purposes. Further, the passwords are usually variations on a theme--a favorite person, animal, place, or other easy-to-remember item, with some variation thrown in, such as a couple of numbers or some letters reversed.

This means that passwords can be guessed. Unless you have a pretty good idea what the person's password might be, however, guessing can be tedious and error prone. This is where software comes into play. Consider, for instance, software like Word Key, found here:

http://www.lostpassword.com/word.htm

This type of software can try thousands and millions of potential passwords faster than you could ever hope to do it. It may cost a bit for the software, but the cost needs to be weighed against the potential value of the information within the document.

There are many other places on the Web that publish information about how to crack a Word password-protected file. You can use any search engine to search for terms such as Word, password, crack, hack, and warez. You may need to do a bit of exploring and experimentation, but the information is there.

Beth's experience, however, does bring up a situation that all companies need to plan for--what happens if a key employee dies or quits? As part of your planning for such eventualities, you may want to implement a policy where passwords for company documents are shared with key personnel, with IT personnel, or stored in some safe "escrow" location so they can be accessed in case of emergency.