The Gun Counter

One of our customers let an employee go for cause last week; when going over that person's desktop PC this week they found many dozens of password protected ZIP files, and they want to find out what is in them.

There are youtube videos and other sites with recommendations but most of them involve 'download the utility at this link!' where we're not sure we can trust the source, and I don't have a sacriificial virtual guest system available right now.

Does anyone have a recommendation for a (hopefully free or low cost) utility for finding a ZIP file password or otherwise breaking the encryption so the contents can be viewed?

CByrneIV wrote:Elcomsoft is the best commercial one.

I have several of their tools (Outlook, Excel 2000, Office, Word 2000, AOL IM), and I thought I used to have one for Winzip. I'll have to check some of my older drives to see if I can find it.

Rich Jordan wrote:One of our customers let an employee go for cause last week; when going over that person's desktop PC this week they found many dozens of password protected ZIP files, and they want to find out what is in them.

There are youtube videos and other sites with recommendations but most of them involve 'download the utility at this link!' where we're not sure we can trust the source, and I don't have a sacriificial virtual guest system available right now.

Does anyone have a recommendation for a (hopefully free or low cost) utility for finding a ZIP file password or otherwise breaking the encryption so the contents can be viewed?

Rich, do you know which version of ZIP was used to create the archives (and what level of encryption)?

308Mike wrote: Rich, do you know which version of ZIP was used to create the archives (and what level of encryption)?

Not at this time. I can probably ask them for one to check (assuming its possible to tell by reviewing the file). The system had the Microsoft built in utility and 7-Zip installed

IIRC, 7zip can cause some issues when trying to do such things as the method of encryption is different.

7zip CAN use AES-256 encryption, so unless you luck out and the former employee is an idiot, you might be in for a long cracking run.

BobbyK wrote:7zip CAN use AES-256 encryption, so unless you luck out and the former employee is an idiot, you might be in for a long cracking run.

That is what I thought...

Though there are legal methods too... Refusing to allow access to such files can result in some pretty serious consequences to a former employee.

Do any of you guys have any experience with these guys (Daossoft)?

As it happens, I don't have any cracking jobs scheduled to run this week.

This is going to sound really stupid but I don;t suppose you could ask for the passwords? I would suggest paying him a bit less than what it would cost to crack them but encouraging danegeld is never a good idea.