Decrypting Password Protected Word 2000 Documents


New Member
Nov 1, 2015

I'm am new to computer forensics. I am currently enrolled in a Digital Forensics I course and am trying to explore outside the course material. I personally have been working as a system administrator for the past 3 years. In class we were given a test image to load into FTK. we are using a free version, which is v1.071 - DEMO. We are using the image to get an introduction to FTK, by using index search to find key data, bookmarking that info and then creating reports.

In the image I noticed that there are several files that FTK has marked as encrypted. Several word documents, and 2 PGP secret key rings. I exported all of the files and the word documents are password protected. My question is how can I decrypt those Word files to gain access?

Also in a forensic scenario, what would an investigator do when confronted with encrypted files? And what tools are available to try and crack them?

About us

  • Our community began in 2004. Since this time, we have grown to have over 29,000+ members within the DFIR & Cyber Security community.

    We are happy to announce that this forum is now under new ownership with the goal to once again become the main Digital Forensics Forum on the internet for DFIR, OSINT and Cyber Security.

    If you can think of ways to help us improve, please let us know.

    We pride ourselves on offering unbiased, critical discussion among people of all different backgrounds.

    We are working every day to make sure our community is one of the best.

Quick Navigation

User Menu