Password Protected Excel 2007/2010 File

At the Orlando .NET Code Camp (the second largest in the US, the largest being South Florida), I did a presentation on OpenXml which is the format behind Office 2007/2010. At this session I was asked a question to which I had no answer.

The question was ‘If I have a password protected Excel from either 2007 or 2010 file, can I use the trick of renaming a file to a zip and then examining the XML to extract the information in that spreadsheet. Well I could not answer this but noted it down for later. So after a little investigation here are my findings.

There are three level’s of password protection offered in Excel (note that I’m using Excel 2010, so there may be differences in 2007). Under the review ribbon bar section, in the Changes tab, there are two of the three options

  1. Protect sheet – which protects the data in a particular sheet, it can also include formatting, adding/deleting rows and columns, etc
  2. Protect workbook – which protects the structure of the workbook i.e. the number of sheets, window layout, etc

These two options protect the spreadsheet but the file can still be easily opened by end users and worked with no password required. So renaming the spreadsheet to a zip file, opening it up and editing the xml files I located and removed the protection that these options add. After opening back up in Excel, everything works as expected from an unprotected spreadsheet. Not unsurprising as these options are not meant to protect sensitive documents, only to stop a user changing the document through carelessness or whatever. I will leave it to you, to figure out which xml file contains the protection element.

The third option is also confusingly called Protect Workbook, but is located under the File/Info tab. From this you can password protect a file such that it cannot be opened without specifying a password. I presumed that after password protecting the file, and saving what I would have is a password protected zip file masquerading as an Excel document. So I renamed it to a zip extension and attempted to open it. Well that didn’t work, that may just be that I’m using an older version of a zip package or more likely MS is encrypting the entire zip file after creation. This was interesting and although not quite what I expected, the file is protected as expected.

So you cannot retrieve the contents of a password protected spreadsheet for which you have forgotten that password by simply renaming it to .ZIP and opening it.

About these ads
This entry was posted in Code Camps, Computers and Internet. Bookmark the permalink.

4 Responses to Password Protected Excel 2007/2010 File

  1. paul s says:

    How can you rename the tab of a protected worksheet? A coworker fond a typo in the tab name. I have unprotected the worksheet but I stll cannot rename the worksheet’s tab. I am using Excel 2010. Thanks for your help. There is no one on the internet that seems to know how to fix this problem.

  2. Colin Blakey says:

    I suspect that the Excel workbook structure has also been password protected. You should be able to confirm this by going to the Review menu option and looking at the ‘Protect Workbook’ item. If it is highlighted, then the workbook structure is also protected. You will need the password for this or if you have saved the spreadsheet out without the overall password protection, you should be able to rename it to a zip and edit the xml to remove this protection. See the article at http://datapigtechnologies.com/blog/index.php/hack-into-a-protected-excel-2007-or-2010-workbook/ for this solution.

  3. Rick Gorskie says:

    Is there any true way to distribute a sheet for use and still envolk a password to protect sections of sensitive data?

    • Colin Blakey says:

      Rick,

      If you don’t want to protect the entire workbook with a password then I don’t think there is a truly secure way to protect this data. You can hide the sheets and protect the workbook structure from changes i.e. you can’t un-hide the sheet, but behind the scenes this is still a zip container with accessible data.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s