Recovery Methodology
Exactly what happens when you upload an Office file — format detection, encryption identification, recovery path selection, and what "guaranteed" and "Fast Check" actually mean technically.
Step 1: Format and encryption detection
Before any recovery attempt, we identify what we're dealing with. The file extension (.xls vs .xlsx) is a rough signal. The real identification comes from reading the file header:
- D0 CF 11 E0— OLE2/Compound File Binary. This is the Office 97-2003 container (.doc, .xls, .ppt). Next step: check for EncryptionInfo stream.
- 50 4B 03 04— ZIP archive. This is the OOXML container (.docx, .xlsx, .pptx). Next step: check for EncryptedPackage or EncryptionInfo XML part.
If an encryption stream/part is found, we extract the encryption metadata: cipher algorithm (RC4, AES-128, AES-256), key derivation function (MD5, SHA-1, SHA-512), and iteration count. This single step determines which recovery path applies.
Path A: 40-bit RC4 key recovery (Office 97-2003)
Files encrypted with Office 97-2003's default 40-bit RC4 use a finite key space: 2^40 ≈ 1.1 trillion possible keys. Modern GPU clusters can exhaustively search this space. The key (no pun intended) insight: we target the cipher key directly, not the user's password. A 4-character password and a 40-character password produce the same 40-bit key from the same finite space.
Technical details
- • Hashcat modes: 9700 (Word/Excel with MD5-based KDF), 9800 (PowerPoint with SHA-1-based KDF)
- • Key space: 2^40 keys, exhaustively searchable
- • Attack: brute force over the cipher key space, not the password space
- • Result: guaranteed recovery for any password complexity
- • Typical duration on our GPU cluster: 2-6 hours
Source: Microsoft [MS-OFFCRYPTO] specification documents the RC4 CryptoAPI encryption mode and its 40-bit key derivation. The finite key space is a direct consequence of US export regulations at the time the format was designed (pre-2000).
Path B: Fast Check (Office 2007+)
Modern Office files use AES-128 or AES-256 with key derivation functions that include significant iteration counts (50,000 to 100,000 SHA-512 rounds per guess). The key space is too large to exhaustively search, so recovery depends on the password.
Fast Check tests a curated dictionary of common human-chosen passwords, names, dates, keyboard patterns, and their common mutations (adding numbers, symbols, capitalization variants). This covers the passwords people actually pick in practice.
What Fast Check tests
- • Common dictionary words and phrases (English, Ukrainian, Russian)
- • Names, dates, and years
- • Keyboard walks and patterns (qwerty123, 1qaz2wsx)
- • Common number suffixes and symbol substitutions (password123, P@ssw0rd)
- • Company-name patterns and default passwords
- • Hashcat modes: 9400 (Office 2007), 9500 (Office 2010), 9600 (Office 2013+)
If Fast Check finds the password, you see a preview before paying. If it doesn't, the file's password is either rare/strong or random — and further recovery options are presented based on what you remember about the password.
What we don't claim
- • We don't claim to recover modern AES-256 Office files with strong random passwords. Cryptographically, that's infeasible regardless of hardware.
- • We don't publish aggregate "success rates" — they're meaningless because recovery depends on the specific file's encryption mode and password strength, not on our tool.
- • We don't do "password recovery" that's actually just sheet protection removal. We're explicit about which protection layer we're targeting.