An open community 
of Macintosh users,
for Macintosh users.

FineTunedMac Dashboard widget now available! Download Here

Topic Options
#14460 - 03/01/11 07:54 AM Is Excel A Polluter?
ryck Offline


Registered: 08/04/09
Loc: Okanagan Valley
It appears that Microsoft Excel is capable of modifying Time Machine historical files.

In another thread I couldn't understand why, after a password was lost, I could not replace a password-protected file with a pre-password version from either Time Machine or Super Duper. These were the critical backstops I should have been able to rely on.

After getting the password and removing it from the Excel file, I did an immediate Time Machine backup. That meant I now had a clean (password free) version on both my main drive and on my Time Machine drive.

I then ran a couple of TM experiments.

1. I replaced the non-password version with a password version (made after the password was introduced) and, as expected, the password was needed.

2. I replaced the password version with the new TM non-password version. The file opened without the password.

3. I then replaced the non-password version with older TM copies, from as long ago as a month before the password was introduced, and every single one wanted a password. I was expecting to get the files originally saved by TM, which were non-password copies.

This seems to suggest a couple of problems:

1. Microsoft Excel is "taking liberties" and inserting a password where it should not - on the historical files of both Time Machine and Super Duper.

2. Time Machine is allowing historical data to be modified when it should not. I'm assuming the same type of file modification happened to the Super Duper drive backup made the day prior to password introduction.

3. Excel does not fix its mistakes. Although the password requirement went backwards through old TM files, a change to non-password did not.

Is there a hole in my logic?

ryck
_________________________
ryck

iMac (Retina 5K, 27", 2017), 3.4 GHz Intel Core i5, 8GB RAM, 2400 MHz DDR4
OS High Sierra 10.13.6
Canon MX710 Printer
Epson Perfection V500 Photo Scanner
Time Machine on 320GB OWC Mercury OTG Pro
Carbon Copy Clone on 500GB OWC Mercury OTG Pro

Top
#14468 - 03/01/11 10:37 AM Re: Is Excel A Polluter? [Re: ryck]
Hal Itosis Offline


Registered: 09/03/09
Loc: 10.6.8 (build 10K549)
Is the password ONLY attached to the file itself?
Or does Excel keep a database somewhere else?

[that saga sounded more like poor design by Microsoft]

Top
#14470 - 03/01/11 11:26 AM Re: Is Excel A Polluter? [Re: Hal Itosis]
ryck Offline


Registered: 08/04/09
Loc: Okanagan Valley
Originally Posted By: Hal Itosis
Is the password ONLY attached to the file itself?
Or does Excel keep a database somewhere else?

I don't know and it's beyond my skills to dig around the drive and find out. You would know better than I. However, I assume that it's not just attached to the file itself, as it got attached to a bunch of them.

However, no matter what the answer, I don't think Excel (or any other software) should be able to go back and change files in Time Machine. That entirely defeats the purpose of having such a backup.

Isn't that a design issue for Apple to be concerned about?

Originally Posted By: Hal Itosis
[that saga sounded more like poor design by Microsoft]

You may be right but it would never have been a saga, or any kind of a thread, if I could have relied on a Time Machine copy of the file. Then I would simply have replaced the file with one that did not have password protection.

I think it's a serious problem if any software can modify backups without the permission of the drive administrator.

ryck


Edited by ryck (03/01/11 11:30 AM)
_________________________
ryck

iMac (Retina 5K, 27", 2017), 3.4 GHz Intel Core i5, 8GB RAM, 2400 MHz DDR4
OS High Sierra 10.13.6
Canon MX710 Printer
Epson Perfection V500 Photo Scanner
Time Machine on 320GB OWC Mercury OTG Pro
Carbon Copy Clone on 500GB OWC Mercury OTG Pro

Top
#14482 - 03/01/11 02:41 PM Re: Is Excel A Polluter? [Re: Hal Itosis]
Virtual1 Offline


Registered: 08/04/09
Loc: Iowa
iirc, when you password protect a word/excel file, it generates a random key and encodes/encrypts the data, and then uses the password you provided to encrypt the key.

office does not store passwords in keychain.

if a non passworded file became passworded, the entire file must have been modified. If this is somehow propogating into apparently older backups, I can only guess it's somehow messing with how time machine tells if a file has been changed.

you can manually browse time machine backups and see different versions, to look for the little arrows by the files to indicate they are hard links instead of the actual file, indicating it's a backup state where the file was not changed since the previous backup ran, so it stored a link to the previously saved copy instead of saving a new copy.
_________________________
I work for the Department of Redundancy Department

Top
#14492 - 03/01/11 05:25 PM Re: Is Excel A Polluter? [Re: ryck]
Hal Itosis Offline


Registered: 09/03/09
Loc: 10.6.8 (build 10K549)
Originally Posted By: ryck
You would know better than I. However, I assume that it's not just attached to the file itself, as it got attached to a bunch of them.

I can only imagine what might be possible, but I've been Microsoft-free since Word 4.0 (which I liked btw), since I switched to ClarisWorks somewhere in the early 90s.


Originally Posted By: ryck
However, no matter what the answer, I don't think Excel (or any other software) should be able to go back and change files in Time Machine. That entirely defeats the purpose of having such a backup.

Isn't that a design issue for Apple to be concerned about?

Apple should prevent you from giving your admin password to Microsoft (installer) software?


Originally Posted By: ryck
You may be right but it would never have been a saga, or any kind of a thread, if I could have relied on a Time Machine copy of the file. Then I would simply have replaced the file with one that did not have password protection.

I think it's a serious problem if any software can modify backups without the permission of the drive administrator.

I don't know if it's been proven that older backups were modified. It's possible that Excel is retroactively protecting older files based on some lookup table (i.e., based on either name or some document ID it could "decide" to start protecting older versions, if enough criteria match. (not saying that's what happened, just that it's not impossible).

Again, as to the older versions in Time Machine's backup, the only thing that could protect them is your admin password... and installers can either store that text or construct some sort of root-helper app at install time.

I don't know whose fault this is, but (so far) Apple's name seems last on the list.

Top
#14497 - 03/01/11 07:53 PM Re: Is Excel A Polluter? [Re: ryck]
ganbustein Offline


Registered: 08/04/09
Originally Posted By: ryck
It appears that Microsoft Excel is capable of modifying Time Machine historical files.

I find that highly unlikely.

Time Machine tries very hard to make its backups immutable. It attaches, to every file it backs up, this ACL:

group:everyone deny write,delete,append,writeattr,writeextattr,chown

The only way Microsoft could modify a file in the backup would be to search for every copy, because in general TM would have backed up several versions of the file, and remove that ACL from each version (which the file's owner can do, despite the deny writeattr), before modifying the file, possibly putting the ACL back to cover its tracks.

That's not impossible, but what would be their motive? Surely even Microsoft couldn't be dumb enough to poison not just one but all of your backups? (Nor do I think Microsoft could be smart enough to pull it off even if they were so inclined. What if the backup volume wasn't mounted at the time? What if, like me, you back up your backups?)

I think Hal's suggestion that the encryption state is stored elsewhere is the more probable, especially since that would also explain why your SuperDuper backup was bad too. In both cases, you recovered the raw file but didn't remove the auxiliary indication that it was supposedly encrypted.

Top
#14498 - 03/01/11 11:15 PM Re: Is Excel A Polluter? [Re: ganbustein]
ryck Offline


Registered: 08/04/09
Loc: Okanagan Valley
Originally Posted By: ganbustein
I think Hal's suggestion that the encryption state is stored elsewhere is the more probable, especially since that would also explain why your SuperDuper backup was bad too. In both cases, you recovered the raw file but didn't remove the auxiliary indication that it was supposedly encrypted.

I don't understand what that means. The only thing I understand is that, whatever the reason, I am in this situation unable to use the Time Machine backup to resolve the problem.

I just now did an experiment. I saved the file under a different name. I then replaced the original with a Time Machine copy from a month prior to the problem date. And yes, it wants the password.

The net result is that, even if the Excel design is not actually changing the TM files, the effect is the same. So, how would I or anyone else using Excel locate/remove the encryption state?

ryck
_________________________
ryck

iMac (Retina 5K, 27", 2017), 3.4 GHz Intel Core i5, 8GB RAM, 2400 MHz DDR4
OS High Sierra 10.13.6
Canon MX710 Printer
Epson Perfection V500 Photo Scanner
Time Machine on 320GB OWC Mercury OTG Pro
Carbon Copy Clone on 500GB OWC Mercury OTG Pro

Top
#14509 - 03/02/11 02:39 PM Re: Is Excel A Polluter? [Re: ryck]
Hal Itosis Offline


Registered: 09/03/09
Loc: 10.6.8 (build 10K549)
Still sounds like an Excel behaviorism is behind this voodoo.

Do you have Numbers?
If so, can Numbers import one of the earlier (non-protected) versions?

Top
#14510 - 03/02/11 03:31 PM Re: Is Excel A Polluter? [Re: Hal Itosis]
ryck Offline


Registered: 08/04/09
Loc: Okanagan Valley
Originally Posted By: Hal Itosis
Numbers import one of the earlier (non-protected) versions?

Nope. An attempt to open the January 31 copy from the Time Machine drive got:

Import Error
The document is encrypted and can’t be opened.

Good thing I finally figured out what the password was.

ryck

UPDATE: I did another test with Numbers. Since it was not able to open the file stored in my Time Machine backup, I thought I'd try it on the original file, with the password now removed.

Numbers opened the file without incident, other than a few cautions about not retaining some formatting. The file is many pages with several links and everything worked fine.


Edited by ryck (03/03/11 06:02 AM)
_________________________
ryck

iMac (Retina 5K, 27", 2017), 3.4 GHz Intel Core i5, 8GB RAM, 2400 MHz DDR4
OS High Sierra 10.13.6
Canon MX710 Printer
Epson Perfection V500 Photo Scanner
Time Machine on 320GB OWC Mercury OTG Pro
Carbon Copy Clone on 500GB OWC Mercury OTG Pro

Top
#14516 - 03/03/11 06:24 AM Re: Is Excel A Polluter? [Re: ganbustein]
ryck Offline


Registered: 08/04/09
Loc: Okanagan Valley
Originally Posted By: ganbustein
[Nor do I think Microsoft could be smart enough to pull it off even if they were so inclined. What if the backup volume wasn't mounted at the time?

I should have provided the following clarification earlier, but I missed this point.

The Time Machine, needing to update regularly, was mounted at the time.

The Super Duper backup was not. It is never turned on except the one time each week when I make the clone. I mounted it only after I could not get a proper restore from Time Machine. I should have pointed you to the original post in the first thread, where I explained:

"Then I turned on my Super Duper drive and dragged a yesterday copy from it to the main drive. You guessed it, it wanted a password.

I then booted from my Super Duper drive and opened the original on that drive. Same thing."


Originally Posted By: ganbustein
I think Hal's suggestion that the encryption state is stored elsewhere is the more probable, especially since that would also explain why your SuperDuper backup was bad too. In both cases, you recovered the raw file but didn't remove the auxiliary indication that it was supposedly encrypted.


Originally Posted By: Hal Itosis
Do you have Numbers? If so, can Numbers import one of the earlier (non-protected) versions?

We are wading in waters a bit too deep for me but, if I apply my simple minded logic...

1. I could not open a pre-password copy (from a month earlier) with either Excel or with the Apple spreadsheet, Numbers.

2. Numbers is capable of opening the non-password version of the spreadsheet but cannot open a Time Machine copy that should never have had a password applied.

....does this not indicate that Excel has actually encrypted (polluted) the Time Machine backups?

ryck


Edited by ryck (03/03/11 06:27 AM)
_________________________
ryck

iMac (Retina 5K, 27", 2017), 3.4 GHz Intel Core i5, 8GB RAM, 2400 MHz DDR4
OS High Sierra 10.13.6
Canon MX710 Printer
Epson Perfection V500 Photo Scanner
Time Machine on 320GB OWC Mercury OTG Pro
Carbon Copy Clone on 500GB OWC Mercury OTG Pro

Top
#14517 - 03/03/11 09:15 AM Re: Is Excel A Polluter? [Re: ryck]
Hal Itosis Offline


Registered: 09/03/09
Loc: 10.6.8 (build 10K549)
Originally Posted By: ryck
The Time Machine, needing to update regularly, was mounted at the time.

The Super Duper backup was not. It is never turned on except the one time each week when I make the clone. I mounted it only after I could not get a proper restore from Time Machine. I should have pointed you to the original post in the first thread, where I explained:

"Then I turned on my Super Duper drive and dragged a yesterday copy from it to the main drive. You guessed it, it wanted a password.

I then booted from my Super Duper drive and opened the original on that drive. Same thing."


[ . . . ]

....does this not indicate that Excel has actually encrypted (polluted) the Time Machine backups?

Possibly.

But —given that the same behavior occured for those SuperDuper backups —it seems more likely that Excel is simply imposing the password requirement at the time you try to open any version associated with the protected version.

What have you done in terms of inspecting these files for changes *outside* of Excel. E.g., look at modified dates or maybe try to peruse the spreadsheets with some sort of hex editor.

I sorta doubt Excel went hunting for all versions the instant you appled the password and managed to actually encrypt the older files. [although your Numbers test leaves me scratching my head: are you sure you hadn't already used Excel to view that version (post password)?]

More likely (seems to me) is that Excel waits until you try to open some older version... and then at that point it decides it should treat it as if it were protected.



Top
#14520 - 03/03/11 09:57 AM Re: Is Excel A Polluter? [Re: Hal Itosis]
ryck Offline


Registered: 08/04/09
Loc: Okanagan Valley
Originally Posted By: Hal Itosis
I sorta doubt Excel went hunting for all versions the instant you appled the password and managed to actually encrypt the older files. [although your Numbers test leaves me scratching my head: are you sure you hadn't already used Excel to view that version (post password)?]

I've done another Numbers test, on a version of the spreadsheet that has never had any viewing attempts. I tried opening the next oldest version, from February 1st. I got:

Import Error
The document is encrypted and can’t be opened.

Originally Posted By: Hal Itosis
What have you done in terms of inspecting these files for changes *outside* of Excel. E.g., look at modified dates or maybe try to peruse the spreadsheets with some sort of hex editor.

Since I used February 1st for the Numbers test, I went to the file on the Time Machine drive and used Get Info. It advised:

Created: Tuesday, May 26, 2009
Modified: Tuesday, February 1, 2011

ryck


Edited by ryck (03/03/11 09:57 AM)
_________________________
ryck

iMac (Retina 5K, 27", 2017), 3.4 GHz Intel Core i5, 8GB RAM, 2400 MHz DDR4
OS High Sierra 10.13.6
Canon MX710 Printer
Epson Perfection V500 Photo Scanner
Time Machine on 320GB OWC Mercury OTG Pro
Carbon Copy Clone on 500GB OWC Mercury OTG Pro

Top
#14525 - 03/03/11 03:15 PM Re: Is Excel A Polluter? [Re: ryck]
dianne Offline

Moderator

Registered: 08/04/09
Hi, ryck

What happens when you open a backup file from Time Machine or SuperDuper when running from a test account?

If necessary, see: Creating a new user account.
_________________________
dianne • moderator

Back up everything you can't afford to lose – documents, mail, movies, music, photos, and other data and settings.

Top
#14532 - 03/04/11 03:00 AM Re: Is Excel A Polluter? [Re: dianne]
ryck Offline


Registered: 08/04/09
Loc: Okanagan Valley
Originally Posted By: dianne
What happens when you open a backup file from Time Machine or SuperDuper when running from a test account?

Hello dianne:

I have a Visitor Account so I used it for this new test.

The Super Duper version isn't relevant anymore because, as soon as I figured out the password, I re-did my Super Duper clone. However, I did re-test the Time Machine using a month old backup.

I used Numbers first but it was still unsuccessful. I got the same Import Error dialogue box. An attempt with Excel resulted in a request for a password.

In both cases I first opened the applications and then clicked through to the file.

ryck


Edited by ryck (03/04/11 05:30 AM)
_________________________
ryck

iMac (Retina 5K, 27", 2017), 3.4 GHz Intel Core i5, 8GB RAM, 2400 MHz DDR4
OS High Sierra 10.13.6
Canon MX710 Printer
Epson Perfection V500 Photo Scanner
Time Machine on 320GB OWC Mercury OTG Pro
Carbon Copy Clone on 500GB OWC Mercury OTG Pro

Top
#14538 - 03/04/11 03:23 PM Re: Is Excel A Polluter? [Re: ryck]
dianne Offline

Moderator

Registered: 08/04/09
ryck,

Thanks for the update.

As you might guess, I was hoping that using a different account to open a Time Machine backup file might have provided more insight.

I remain puzzled by your experiences. I will continue to ponder.
_________________________
dianne • moderator

Back up everything you can't afford to lose – documents, mail, movies, music, photos, and other data and settings.

Top
#14540 - 03/04/11 05:48 PM Re: Is Excel A Polluter? [Re: dianne]
ryck Offline


Registered: 08/04/09
Loc: Okanagan Valley
What puzzles me now, dianne, is why Excel continues to think it should be asking for a password.

If what hal said is the answer: "it seems more likely that Excel is simply imposing the password requirement at the time you try to open any version associated with the protected version", then Excel doesn't seem able to change its modus operandi.

That is, it continues asking for a password for any version associated with the original file, even after the original file no longer needs one.

I removed the password from the original file and yet Excel keeps asking for it on the backups. I think that's a problem that Excel users should be aware of.....if my logic isn't flawed. It seems to me that, if it can impose a condition once, it should be able to impose a second that over-rides the first.

My Excel is from MS Office 2004. I wonder if the same problem exists in more current versions?

ryck


Edited by ryck (03/04/11 05:54 PM)
_________________________
ryck

iMac (Retina 5K, 27", 2017), 3.4 GHz Intel Core i5, 8GB RAM, 2400 MHz DDR4
OS High Sierra 10.13.6
Canon MX710 Printer
Epson Perfection V500 Photo Scanner
Time Machine on 320GB OWC Mercury OTG Pro
Carbon Copy Clone on 500GB OWC Mercury OTG Pro

Top
#14542 - 03/04/11 06:14 PM Re: Is Excel A Polluter? [Re: ryck]
ganbustein Offline


Registered: 08/04/09
Originally Posted By: ryck
My Excel is from MS Office 2004.

Then it could not possibly be modifying the Time Machine backups.

2004 predates Time Machine. Heck, it predates Tiger (released April 2005). Time Machine uses ACLs to mark its backups read-only. ACLs were not commonly enabled until Leopard, and even on Tiger they were an exotic feature that could only be enabled through some pretty obscure Terminal magic. A 2004 version of Excel could not possibly know how to bypass them. (Any version of the OS that supports TM does know how to enforce them, though.)

There is also no way Excel could modify a file on a SuperDuper backup on a turned-off disk.

I can't tell you what's going on, but I can say with certainty that modifying backups isn't it.

Top
#14583 - 03/06/11 08:57 AM Re: Is Excel A Polluter? [Re: ganbustein]
ryck Offline


Registered: 08/04/09
Loc: Okanagan Valley
Originally Posted By: ganbustein
I can't tell you what's going on, but I can say with certainty that modifying backups isn't it.

I thought I'd do a bit of detective work using CleanApp since, when an application is selected for deletion, CleanApp will list a large number of items associated with the application.

I didn't intend to delete Excel but I thought the expected CleanApp list of associated items might include a clue to what was causing the problem. i.e. Excel continues demanding passwords on backups of a file that no longer needs one.

However, when I selected Excel in the CleanApp list of applications, I got this dialogue:


CleanApp hasn't found any related files

There are no entries for this file within the CleanCommunity.

CleanApp's Logging service doesn't know the file.



So, I guess we'll never know. I also guess Hercule Poirot would not be impressed with my detective work.

ryck


Edited by ryck (03/06/11 08:57 AM)
_________________________
ryck

iMac (Retina 5K, 27", 2017), 3.4 GHz Intel Core i5, 8GB RAM, 2400 MHz DDR4
OS High Sierra 10.13.6
Canon MX710 Printer
Epson Perfection V500 Photo Scanner
Time Machine on 320GB OWC Mercury OTG Pro
Carbon Copy Clone on 500GB OWC Mercury OTG Pro

Top

Moderator:  alternaut, dianne, dkmarsh