1

I have a folder with very important files on my computer and I zipped it with a password for security reasons. Unfortunately, I'm not able to recover the password. Usually, I always use the same kind of passwords but I have done dozens of tries and I can't remember what the password is. I usually use passwords of 10 to 20 letters with possible upper case letters and numbers which means it's basically impossible to crack it by pure brute force. Since I've tried all the patterns I usually use, I think I may have used a different password from usual so it's not possible to crack it using patterns with brute force.

Basically I don't think there exist IA techniques able to retrieve the password since it can be very long and I have no information about it. So my question is : is there a way for me to retrieve the password of my file ? Since I created it with my user session on Windows, maybe it's possible to deactivate the password for the same user ? I'm not very good at computer science but I hope there is a way to retrieve it because the information in that file are really important.

Alexis Wilke
  • 862
  • 5
  • 19
Julien Mertz
  • 111
  • 1
  • 4
  • Yeah. For the file format to be safe with a password, you encrypt the file using the password as a form of hash to process the content of your file. So in other words, without that password, you can't decrypt the file. Now if someone can determine the encryption used, we may have better ways than the full brute force way to find the necessary key. I tried brute force the other day for a customer account and spend about 90 days CPU time (my computer has 64 CPUs...) to no avail... – Alexis Wilke Feb 10 '20 at 00:10
  • How can I know the encryption used ? To encrypte the file, I created an archive then clicked on "defining a password" and that's it (I'm using Windows 10). – Julien Mertz Feb 10 '20 at 00:14
  • I do not know. But I would imagine some people have worked on such things and would have a more definitive answer. On my end, I use a different random password for each account/file/whatnot... and keep those in [KeyPassXC](https://keepassxc.org/). That way I never even learn my passwords (except the one to open the KeePassXC file). – Alexis Wilke Feb 10 '20 at 00:18
  • So it's impossible to recover/break my password ? – Julien Mertz Feb 10 '20 at 00:28
  • 1
    Does this answer your question? [How to recover a lost zip file password (Extract Zip Spec '2.0')](https://security.stackexchange.com/questions/140029/how-to-recover-a-lost-zip-file-password-extract-zip-spec-2-0) – ThoriumBR Feb 10 '20 at 00:32
  • What zip software did you use? PKZip? WinZip? WinRAR? Some other Zip software? Each one has a different kind of encryption. Some are possible to break, others aren't. – Mike Stay Aug 08 '21 at 23:06

1 Answers1

1

Recent analysis has revealed exploitable weaknesses in some PKZip variants that some software can leverage, such as the the latest beta of hashcat. These weakness allow for very high speed for 15 characters or less.

If you're willing to study the use of hashcat, and do the work work to get it set up on a system with a relatively modern GPU, hashcat can crack these at pretty high speeds - but the learning curve can be steep.

Royce Williams
  • 9,128
  • 1
  • 31
  • 55