Password Removal#

Viewpoint supports password removal from Microsoft Outlook, Word, Excel and PowerPoint ‘95 or higher, Visio 2007 or higher, Adobe PDF, Zip and RAR archives.

Removal Method#

Viewpoint uses a dictionary file method for password removal, except in the case of restriction passwords for PDFs (block PDF documents from printing), which Viewpoint removes instantly. Viewpoint does not support a direct brute force method in which all password possibilities of a specific length and character set will be tried, but such a list can be generated outside of the application and used as a dictionary file by Viewpoint. The direct brute force method is only doable for very short passwords and small character sets. For example, for a five letter lower case password, there are approximately 12 million combinations, but add an uppercase character to the mix and there are now 380 million combinations, which cannot be looped through in a reasonable timeframe.

Sample dictionary files are available on the Viewpoint support site. Additional dictionary files are available on the internet (for example, specific password list for Japanese files), or the user can generate their own. Self-generated dictionary files are preferable; as tests indicate that they return the best results. A standard three million dictionary files will have a 15% to 25% success rate depending on the document set. With a custom dictionary file generated from the ‘Words List’ maintenance script in Viewpoint, tests have shown successful password removal for up to 70% of protected documents. In addition to using the dictionary file, Viewpoint will use available document metadata (i.e. author, company, title, etc.) to create additional passwords to try.

In order to use a dictionary file, the desired set of documents need certain Viewpoint processing operations performed. For archive files, the extract task needs to be completed. For Microsoft Office and Adobe files, extract, metadata, and text tasks need to be completed. Because Viewpoint caches the password list in memory for optimal performance, the maximum size of the dictionary file is limited to 150 MB.

Once a password is found, it is recorded into a ‘password’ field in the database. For non-archive files, the original document will be saved as a backup with ‘_encrypted’ added to the extension and a copy of the document with the password removed will take its place. For example, after running successfully on document ‘000001.pdf’, there will be two files in the e-file folder; the unprotected ‘0000001.pdf’ and the original ‘0000001.pdf_encrypted’.

As long as the option ‘Remove Restrictions from PDF Documents’ is set to True, PDF documents with a ‘user password’ will be unlocked regardless if a dictionary file was used or not. ‘ProtectionTypes.UserPassword’ will be saved in the ‘password’ field as an indicator that password removal took place.

Note: Hashing a password protected document that has had the password removed will result in a different hash than the original document. In the interest of deduplication accuracy, it is recommended that these files be hashed prior to removing any password protection or using the ‘Remove Restrictions from PDF Documents’ processing option.

Speed and Limitations#

Time benchmarks were measured on a Windows 7, 64 bit, Intel 4 core, 2.83 GHz CPU machine. Unlike other processes that run on the workers, password removal is multi-threaded on the same worker. While advantageous for speed, this means that the worker will not able to execute anything else while running password removal on a document as the CPU utilization will be usually > 95%. Adding more cores to the worker will improve results proportionally, i.e. 8 cores machine should have double the performance compared to 4 cores.

Viewpoint does not currently utilize OpenCL/CUDA-compatible GPUs for password removal but this is planned for a future release.

* 1 File per archive

**500 files per archive

Depending on the encryption methods, password removal can be a few orders of magnitude slower than others. If you have a project with a mixture of slow and fast file encryption types, it is recommended to first run password removal over the fast documents with a large dictionary file, collect the list of passwords found in this set and add them to smaller dictionary file. Then run the slower file encryption types with the smaller dictionary file. The idea behind this is that there is normally a good chance that document authors used the same password for different file types. Additionally, putting found passwords at the top of the dictionary file will allow for documents with those passwords to be cracked almost instantly the next time the password removal process is run.

WinZip file speed greatly depends on the number of files in the archive. The more files contained in the archive, the faster the process will be.

RAR file speed can be slow for a couple of reasons. The encryption itself and lack (by design) of password validation, which requires for every try to run extraction and calculation of CRC of extracted file to compare with CRC stored in the archive.

MS Office 2007 utilizes a special technique against password cracking by calculating SHA-1 hashcode 50,000 times in order to retrieve the decryption key. MS Office 2010 bumps it up to 100,000. As this number is stored in encryption information, future versions of MS Office can use an even higher number without breaking compatibility with older versions.

It is recommended to first process your data with password removal OFF. Afterwards, you can analyze the number and types of password protected documents and plan your password removal process accordingly.