Recover password file .7z partially known

[antwane]

Hi,

I'm a beginner, but I need to extract an old file (7-zip) that I protected 4 years ago...
I think to know partially the password.
Below, an example of the search I'd like to do.

Prefix (2 choice): tv4kg58 or rG8pfE5
Suffix : 4 or 5 alphanumeric characters

And perhaps $ at the beginning or at the end.

Thank you in advance

[slyexe]

extract the hash with 7z2hashcat first and confirm it looks similar to that of the example hash found on the wiki.

Then build your script for hashcat. Just use a bruteforce attack in my opinion. 
./hashcat64  -1 ?l?u?d -a 3 -m 11600 -w 4 -i --increment-min 11 --increment-max 12 hashfile.txt yourprefix?1?1?1?1?1

this does not include the perhaps $ at the beginning or at the end portion

Here's a benchmark of 1070 for your knowledge of how fast you're gonna be working at this.

Code:

OpenCL Platform #3: NVIDIA Corporation
======================================
* Device #4: GeForce GTX 1070, 2048/8192 MB allocatable, 15MCU

Benchmark relevant options:
===========================
* --optimized-kernel-enable

Hashmode: 11600 - 7-Zip

Speed.Dev.#4.....:     5843 H/s (20.37ms)

Good luck.

[antwane]

extract the hash with 7z2hashcat first and confirm it looks similar to that of the example hash found on the wiki.

It's a bad start, when I use 7z2hashcat (7z2hashcat64-1.2.exe), I have this message :

Code:

WARNING: the file blablabla.7z' unfortunately can't be used with hashcat since the data length in this particular case is too long (3086944 of the maximum allowed 327528 bytes).

[philsmd]

That's a 3 MB file compressed (uncompressed maybe even much larger if not totally random data).
Are there several files within the .7z file ?
You could also try to increase the limit that hashcat accepts for 7-Zip hashes as mentioned a couple of times within this forum (but at your on risk, the hash will be very, very, very long... the memory consumption will also increase a lot over 3 MB and you would need to test it a lot if everything is working correctly with higher limits... but lzma1/lzma2 decompression to check the checksum shouldn't be a problem even with much larger files).

[antwane]

7-zip file contains 3 files (two .rar file and one .xls),
This is .xls file that I want to recover.

I'm going to look at how to increase the limite.
Thanks