Need help decrypting word doc

[Corey Edwards]

On Tue, 2009-05-19 at 21:40 -0600, Andy Bradford wrote:
> Thus said "Jared W. Robinson" on Tue, 19 May 2009 06:05:47 MDT:
> 
> > My grandmother has been working on an obituary for my grandfather (who
> > is still with us), but somehow  it got encrypted, and she doesn't know
> > what the password  is. I'm looking for someone who  can decrypt it for
> > me.
> 
> Is the file  encrypted or merely password protected? If  the latter, you
> could use strings to extract out the data. Otherwise, Nick suggested you
> find a  temporary copy... what  about using something like  sleuthkit to
> mine your hard drive? Or you could use some of the tools in Hiren's boot
> CD to extract the data. Basically, any file recovery tools might be able
> to  locate an  extra  copy. A  lot  might depend  on  whether Word  just
> overwrites blocks,  or if it creates  temporary copies as it  works on a
> file.  How much time do you have to recover the file?

I once recovered a Word document that a friend had accidentally deleted.
I can confirm that Word creates temporary copies and if you search the
dead space on your drive, you'll find many many old copies of your
document. It ain't pretty, but it'll get the job done.

Corey

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: This is a digitally signed message part
Url : http://plug.org/pipermail/plug/attachments/20090520/d81dca72/attachment.bin