compuzak1
asked on
Decrypt Excel Spreadsheet
I had an XP SP3 PC that would no longer boot and I took the disk out of that PC and placed into a similar XP SP3 PC to extract the data. All the data copied successfully except for 100 or so Excel 2003 Spreadsheets that had been encrypted using the Excel 2003 encryption. A backup of the encryption key was never made, but the encryption information is still on the hard disk (now configured a secondary disk on the new pc). The password is known (at least we think it is known), but since the file is encrypted I can't open the file in Excel to enter the password. It tells me the file is encrypted. It also shows green in the file list when using file explorer on the XP PC. How can I decrypt these spreadsheets so that I can save them without the encryption?
Any help would be greatly appreciated.
Any help would be greatly appreciated.
Tony Barkdull
If you know the password, then it should prompt you for the password when trying to open it. I tested this by saving a file on one machine (to a network location) and opened it from another machine successfully after entering the password. If the password is unknown, then you will need to employ other means to recover them. Excel 2003 passwords are not as secure as newer versions. I have used a software tool called Passkey (I think) to recover Office 2003 password protected files.
compuzak1,
I think you are out of luck. You can treat that the excel files are gone for good if you didn't backup your encryption certificate, there is virtually no way to decrypt the data.
The encryption certificate is not something you can find in file system by browsing around the hard drive with windows explorer. It's encrypted and stored somewhere on the hard drive but not in a usable form if your old machines is no longer working.
I think you are out of luck. You can treat that the excel files are gone for good if you didn't backup your encryption certificate, there is virtually no way to decrypt the data.
The encryption certificate is not something you can find in file system by browsing around the hard drive with windows explorer. It's encrypted and stored somewhere on the hard drive but not in a usable form if your old machines is no longer working.
ASKER
No, as I mentioned in the writeup, it does not prompt for password. The exact message I get when I try to open from Excel is: Excel cannot access 'filename.xls', the document may be read only or encrypted.
The encrypted box is checked in the advanced properties and when I try to remove it, it gives me this error message: An error occurred trying to apply attributes to the file. Access is denied.
I tried taking ownership of the file and giving me full permissions, but nothing will allow me to open it and enter a password or remove the checkbox on the encryption. I thought it might prompt for password when I removed the check box, but it does not it gives an error message as described above.
The encrypted box is checked in the advanced properties and when I try to remove it, it gives me this error message: An error occurred trying to apply attributes to the file. Access is denied.
I tried taking ownership of the file and giving me full permissions, but nothing will allow me to open it and enter a password or remove the checkbox on the encryption. I thought it might prompt for password when I removed the check box, but it does not it gives an error message as described above.
compuzak1,
I fully understanding what you mean. I know Excel password is not your problem. Your problem is Windows built-in EFS encryption. As I said, you are absolutely out of luck if you didn't backup the encryption certificate.
When I mentioned that there is virtually impossible to decrypt the files, I mean, if you are good at hacking, it will still takes you decades to decrypt the file using brute force to regenerate the encryption key.
Windows EFS is designed to protect the files, and it's good at it.
Your situation is pretty much same as someone (a stranger) got his hand on someone else hard drive, and try to look into the files. If there is a backdoor to decrypt the files, it's not a true encryption system.
I know it's not what you want to hear but face the truth. You have loose all those excel files if did not backup the encryption certificate.
Your best chance is to fix the damaged computer if the damage is minor (software issue). If it's your motherboard that cause the system to fail, don't bother replacing to the same model of motherboard. It's not going to help you the system will not generate the same encryption key. If it's only capacitor failing on the motherboard, it may worth to give it a try in replace the capacitors to revive the machine.
I fully understanding what you mean. I know Excel password is not your problem. Your problem is Windows built-in EFS encryption. As I said, you are absolutely out of luck if you didn't backup the encryption certificate.
When I mentioned that there is virtually impossible to decrypt the files, I mean, if you are good at hacking, it will still takes you decades to decrypt the file using brute force to regenerate the encryption key.
Windows EFS is designed to protect the files, and it's good at it.
Your situation is pretty much same as someone (a stranger) got his hand on someone else hard drive, and try to look into the files. If there is a backdoor to decrypt the files, it's not a true encryption system.
I know it's not what you want to hear but face the truth. You have loose all those excel files if did not backup the encryption certificate.
Your best chance is to fix the damaged computer if the damage is minor (software issue). If it's your motherboard that cause the system to fail, don't bother replacing to the same model of motherboard. It's not going to help you the system will not generate the same encryption key. If it's only capacitor failing on the motherboard, it may worth to give it a try in replace the capacitors to revive the machine.
ASKER
Sorry HarryHYLee, that comment was directed towards tbarkdull, you came in as I was writing the reply to him.
I saw some software that said it could decrypt the files for $29 per file as long as they were in Excel 2003 or earlier (uses a 40-bit encryption key according to the website) and will decode the file in minutes. But I have about 100 of these files, so that option will not be cost effective.
I can see the certificate on the file and states that administrator@OldPCName is an authorized user. I am logged into the machine as adminstrator@NewPCName so they are not matching. I tried to add the user but it gives me an error code 5 and does not allow me to add the new user.
Do you think it is worthwhile to try changing the computer name to OldPCName so that it matches? I would think this will be a waste of time as I would imagine it stores a number that references the PC name and not the actual text. What do you think?
I saw some software that said it could decrypt the files for $29 per file as long as they were in Excel 2003 or earlier (uses a 40-bit encryption key according to the website) and will decode the file in minutes. But I have about 100 of these files, so that option will not be cost effective.
I can see the certificate on the file and states that administrator@OldPCName is an authorized user. I am logged into the machine as adminstrator@NewPCName so they are not matching. I tried to add the user but it gives me an error code 5 and does not allow me to add the new user.
Do you think it is worthwhile to try changing the computer name to OldPCName so that it matches? I would think this will be a waste of time as I would imagine it stores a number that references the PC name and not the actual text. What do you think?
ASKER
Also, isn't there anyway to grab this certificate and modify since I know the password associated with this encryption key? I found the key on the old disk in the user profile directory C:\Documents and Settings\< username >\Application Data\Microsoft\Crypto\RSA.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Thank you for your detailed explanation. The website did say for excryption but I completely agree with what you are saying. Regardless, I am not paying $29 per file which will be close to 3 grand. You are probably right, the best way to get it back it to revive the old computer. I will wait a few days to make sure there is not some hidden solution that one of these Experts Exchange experts has figured out. I am pretty sure there is not, so if I don't receive any other feedback in the next couple of days I will reward the points to you and close out this question. Even though this is not the result I was hoping for, thanks for your help.
compuzak1,
The points doesn't matter.
If you don't mind, tell me what's the problem with the old computer and the computer model if it's a brand name computer.
Maybe I can help reviving the machine.
The points doesn't matter.
If you don't mind, tell me what's the problem with the old computer and the computer model if it's a brand name computer.
Maybe I can help reviving the machine.
ASKER
The PC is shutting down on bootup with a thermal overload error. Some of the the capacitors are bulging and leaking and need to be replaced or the motherboard replaced. It is a very old Dell Optiplex GX270 and I think I can round up a spare motherboard from a junked GX270 (I am not very good at soldering so I will most likely replace the entire motherboard). It sure sounds like that is the only way I am going to get these data files. I have replaced a motherboard before, not too much trouble if I remember right. If I replace with same motherboard, and put everything back in the same exact slots, should I just be able boot up using the same primary hard disk? Will changing the motherboard affect the encryption at all? Thanks for all your help.
ASKER
HarryHYLee, I followed your advice and instead of trying to decrypt the files by hacking, I revived the computer and then removed the decryption from the spreadsheets. I was happy to see that it allowed me to change all the folders and sub folders and files with one operation as there were over 200 files. Thank you for your help and good advice.
I'm glad you can recovery all the necessary files.
You should consider yourself lucky. Normally, replacing the motherboard would cause Windows to consider it as a different machine, and not willing to let you into the EFS.
I'm happy that solved your problem.
You should consider yourself lucky. Normally, replacing the motherboard would cause Windows to consider it as a different machine, and not willing to let you into the EFS.
I'm happy that solved your problem.