Hi Lyle, thanks for your response.  I'm right on the edge of my knowledge on
this so thanks for your patience.  Here's the full code (you're right about
the XOR) - IIRC it originated from Micheal Kaplan (and I've probably spelt
that wrong).  It works in A97 but not in A2k3.  It seems to fall over where
the empty password array is set.  Any help greatly appreciated.  And before
anyone jumps in with the rights and wrongs of password cracking, I have a
genuine and legal use for a working version of this code.

Public Function StPasswordOfStDatabase(stDatabase As String) As String
   Dim hFile As Integer
   Dim ich As Integer
   Dim stBuffer As String
   Dim rgbytRaw() As Byte
   Dim rgbytPassword() As Byte
   Dim rgbytNoPassword() As Byte

   ' Create the byte array with the 20 bytes that are present when there
   ' is no database password
   rgbytNoPassword = ChrB(134) & ChrB(251) & ChrB(236) & ChrB(55) &
ChrB(93) & _
                               ChrB(68) & ChrB(156) & ChrB(250) & ChrB(198)
& ChrB(94) & _
                               ChrB(40) & ChrB(230) & ChrB(19) & ChrB(182)
& ChrB(138) & _
                               ChrB(96) & ChrB(84) & ChrB(148) & ChrB(123)
& ChrB(54)

   ' Grab the 20 bytes from the real file whose password
   ' we are supposed to retrieve
   hFile = FreeFile
   Open stDatabase For Binary As #hFile
   Seek #hFile, 66 + 1
   rgbytRaw = InputB(20, #hFile)
   Close #hFile

   ' Enough prep, lets get the password now.
   ReDim rgbytPassword(0 To 19)
   For ich = 0 To 19
       rgbytPassword(ich) = rgbytRaw(ich) Xor rgbytNoPassword(ich)
   Next ich

   ' Add a trailing Null so one will always be found, even if the password
is 20
   ' characters. Then grab up to the first null we find and return the
password
   stBuffer = StrConv(rgbytPassword, vbUnicode) & vbNullChar
   'StPasswordOfStDatabase = Left$(stBuffer, InStr(1, stBuffer, vbNullChar,
vbBinaryCompare) - 1)
   StPasswordOfStDatabase = stBuffer

'To reveal the password, type this into the debug window: ?
StPasswordOfStDatabase("c:\foo.mdb")
'Where("c:\foo.mdb") is the path to and name of the db file

End Function

So it looks like my problem is that the blank database password string is
different between 97 and 2k3, is that a reasonable assumption?  As I stated
in my reply to Lyle, this code works in A97.

Keith.