Password Recovery Programs > Advanced PDF Password Recovery > Using the program > Selecting the attack

For PDF files created with legacy versions of Adobe software, you may be able to attack the encryption key instead of the password. This only works for 40-bit keys and RC4 encryption.

In PDF 1.2/1.3 files (Acrobat 4.x or older), the key length in 40 bits, and the total number of keys is 2^40, or 1,099,511,627,776. The key space is divided into 65,536 blocks, with 16,777,216 keys per block; the recovery process takes several hours on modern processors.

Specify the start block (Start from block input box) and ending block (End at block box); the values con be from 0 to 65536. During the attack, the program shows the number of the current block, time elapsed, average speed (in keys per second), number of keys already processed and the total number of keys. When the key is found, the program displays the key it and prompts to decrypt the file. If you already know the key, enter it into the Document key box and press Decrypt.

The Enterprise edition allows to speed up the attack by enabling the use of pre-computed hash tables. Press Select user hashes directory and browse for the folder where the tables are located. This folder should contain the following folders/files (Thundertables):

0\t00_l17000.data

0\t00_l17000.index

1\t01_l17000.data

1\t01_l17000.index

2\t02_l17000.data

2\t02_l17000.index

3\t03_l17000.data

3\t03_l17000.index

4\t04_l17000.data

4\t04_l17000.index

5\t05_l17000.data

5\t05_l17000.index

missing.bin

We recommend storing the tables on a SSD drive or a fast flash drive. In this case, the attack takes several seconds to several minutes. This option provides guaranteed recovery.

This attack is not applicable to PDF files created in Adobe Acrobat 5.0 and later due to the improved security level featuring 56-bit to 256-bit encryption keys.

Key search

Key search