Decrypt Excel Spreadsheet

I had an XP SP3 PC that would no longer boot and I took the disk out of that PC and placed into a similar XP SP3 PC to extract the data.  All the data copied successfully except for 100 or so Excel 2003 Spreadsheets that had been encrypted using the Excel 2003 encryption.  A backup of the encryption key was never made, but the encryption information is still on the hard disk (now configured a secondary disk on the new pc).  The password is known (at least we think it is known), but since the file is encrypted I can't open the file in Excel to enter the password.  It tells me the file is encrypted.  It also shows green in the file list when using file explorer on the XP PC.  How can I decrypt these spreadsheets so that I can save them without the encryption?

Any help would be greatly appreciated.
compuzak1Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Tony BarkdullTier 2 SupportCommented:
If you know the password, then it should prompt you for the password when trying to open it. I tested this by saving a file on one machine (to a network location) and opened it from another machine successfully after entering the password. If the password is unknown, then you will need to employ other means to recover them. Excel 2003 passwords are not as secure as newer versions. I have used a software tool called Passkey (I think) to recover Office 2003 password protected files.
0
Harry LeeCommented:
compuzak1,

I think you are out of luck. You can treat that the excel files are gone for good if you didn't backup your encryption certificate, there is virtually no way to decrypt the data.

The encryption certificate is not something you can find in file system by browsing around the hard drive with windows explorer. It's encrypted and stored somewhere on the hard drive but not in a usable form if your old machines is no longer working.
0
compuzak1Author Commented:
No, as I mentioned in the writeup, it does not prompt for password.  The exact message I get when I try to open from Excel is:  Excel cannot access 'filename.xls', the document may be read only or encrypted.

The encrypted box is checked in the advanced properties and when I try to remove it, it gives me this error message:  An error occurred trying to apply attributes to the file.  Access is denied.

I tried taking ownership of the file and giving me full permissions, but nothing will allow me to open it and enter a password or remove the checkbox on the encryption.  I thought it might prompt for password when I removed the check box, but it does not it gives an error message as described above.
0
Introducing Cloud Class® training courses

Tech changes fast. You can learn faster. That’s why we’re bringing professional training courses to Experts Exchange. With a subscription, you can access all the Cloud Class® courses to expand your education, prep for certifications, and get top-notch instructions.

Harry LeeCommented:
compuzak1,

I fully understanding what you mean. I know Excel password is not your problem. Your problem is Windows built-in EFS encryption. As I said, you are absolutely out of luck if you didn't backup the encryption certificate.

When I mentioned that there is virtually impossible to decrypt the files, I mean, if you are good at hacking, it will still takes you decades to decrypt the file using brute force to regenerate the encryption key.

Windows EFS is designed to protect the files, and it's good at it.

Your situation is pretty much same as someone (a stranger) got his hand on someone else hard drive, and try to look into the files. If there is a backdoor to decrypt the files, it's not a true encryption system.

I know it's not what you want to hear but face the truth. You have loose all those excel files if did not backup the encryption certificate.

Your best chance is to fix the damaged computer if the damage is minor (software issue). If it's your motherboard that cause the system to fail, don't bother replacing to the same model of motherboard. It's not going to help you the system will not generate the same encryption key. If it's only capacitor failing on the motherboard, it may worth to give it a try in replace the capacitors to revive the machine.
0
compuzak1Author Commented:
Sorry HarryHYLee, that comment was directed towards tbarkdull, you came in as I was writing the reply to him.  

I saw some software that said it could decrypt the files for $29 per file as long as they were in Excel 2003 or earlier (uses a 40-bit encryption key according to the website) and will decode the file in minutes.  But I have about 100 of these files, so that option will not be cost effective.

I can see the certificate on the file and states that administrator@OldPCName is an authorized user.  I am logged into the machine as adminstrator@NewPCName so they are not matching.  I tried to add the user but it gives me an error code 5 and does not allow me to add the new user.

Do you think it is worthwhile to try changing the computer name to OldPCName so that it matches?  I would think this will be a waste of time as I would imagine it stores a number that references the PC name and not the actual text.  What do you think?
0
compuzak1Author Commented:
Also, isn't there anyway to grab this certificate and modify since I know the password associated with this encryption key?  I found the key on the old disk in the user profile directory C:\Documents and Settings\< username >\Application Data\Microsoft\Crypto\RSA.  It is frustrating that I can see the file and have the password, but can't open the Excel Spreadsheet.
0
Harry LeeCommented:
compuzak1,

Please be careful before you spend that $29 dollars. What is means is the password protected excel file. That's a totally different story. If you have a password protect excel or word file, and have forgotten the password, using brute force to get the password is normally not too hard. Basically doing a-z, A-Z, 1-0, and symbols loop. Normally people do not create password more than 11 characters long. It's super easy to brute force hack the file.

If that was your problem, I would have already told you to use software like FREE Word and Excel password recovery Wizard to brute force hack the file.

Your problem is not that simple. When you mention that the filename is in green text, it means that the file is encrypted with Windows EFS, which uses a computer generated security certificate. They are normally 128bit, 256bit, 512bit, or in some rare cases 168bit or even 1024bit. In extreme cases, 2048bit.

By default, windows uses 128bit encryption, means there are a 2^128 combinations. Which is  340,282,366,920,938,000,000,000,000,000,000,000,000 combinations

Believe it, it's virtually impossible to brute force regenerate the key code.

In terms of changing the computer name, it's not going to do a thing. The certificate is generated based on a lots of parameters. Not just the computer name. it utilize a much more advanced random such as Time, Date, Motherboard ID, CPUID, ram amount, etc. It's close to impossible to regenerate the same code again with a different machine. In fact, not even on the same computer.

As I mentioned in last post, unless you have backup the certificate, it's virtual impossible to get the files back. I think there are only 1 person on earth who can hack 1024 bit encryption and only a handful of people who can hack 512 bit encryption (please don't quote me on that. I recall that vaguely).

Instead of trying to decrypt the files by hacking it, I would suggest you to focus on reviving that old computer.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
compuzak1Author Commented:
Thank you for your detailed explanation.  The website did say for excryption but I completely agree with what you are saying.  Regardless, I am not paying $29 per file which will be close to 3 grand.  You are probably right, the best way to get it back it to revive the old computer.  I will wait a few days to make sure there is not some hidden solution that one of these Experts Exchange experts has figured out.  I am pretty sure there is not, so if I don't receive any other feedback in the next couple of days I will reward the points to you and close out this question.  Even though this is not the result I was hoping for, thanks for your help.
0
Harry LeeCommented:
compuzak1,

The points doesn't matter.

If you don't mind, tell me what's the problem with the old computer and the computer model if it's a brand name computer.

Maybe I can help reviving the machine.
0
compuzak1Author Commented:
The PC is shutting down on bootup with a thermal overload error.  Some of the the capacitors are bulging and leaking and need to be replaced or the motherboard replaced.  It is a very old Dell Optiplex GX270 and I think I can round up a spare motherboard from a junked GX270 (I am not very good at soldering so I will most likely replace the entire motherboard).  It sure sounds like that is the only way I am going to get these data files.  I have replaced a motherboard before, not too much trouble if I remember right.  If I replace with same motherboard, and put everything back in the same exact slots, should I just be able boot up using the same primary hard disk?  Will changing the motherboard affect the encryption at all?  Thanks for all your help.
0
compuzak1Author Commented:
HarryHYLee, I followed your advice and instead of trying to decrypt the files by hacking, I revived the computer and then removed the decryption from the spreadsheets.  I was happy to see that it allowed me to change all the folders and sub folders and files with one operation as there were over 200 files.  Thank you for your help and good advice.
0
Harry LeeCommented:
I'm glad you can recovery all the necessary files.

You should consider yourself lucky. Normally, replacing the motherboard would cause Windows to consider it as a different machine, and not willing to let you into the EFS.

I'm happy that solved your problem.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Excel

From novice to tech pro — start learning today.