RICOH ADDRESS BOOK DECODER

How Ricoh address-book encryption works

October 12, 2026 · 6 min read

A Ricoh multifunction printer keeps its contacts, scan destinations and the credentials used to reach them in a single store it calls the address book. When an administrator backs that store up, the device writes a UCS backup — a file that usually carries a .udf extension and begins with a short, readable header.

The file has two halves

Open a backup in a hex editor and you see a plain-text header, then a block of binary. The header is a handful of #Key:Value lines:

#UCS address entries Backup
#Format Version:3.4.31.0
#Device name:IM7000
#Address:192.168.0.83
#DeviceID:58:38:79:80:8f:32
#Entries

Everything after the #Entries marker is the encrypted payload. The header itself is never encrypted, which is why a backup leaks the device model and its network address even before you decrypt anything.

The encryption

The payload is encrypted, but the scheme is designed to deter casual inspection rather than a determined examiner who already holds the file. In practice a backup with a known or empty password is recoverable, and many are exported with no password at all — leaving the contents effectively in the clear. This tool handles the details server-side; you don't need to understand the scheme to read a backup you're authorized to examine.

What's inside

Decrypted, the payload is a set of CSV-like lines, one record per line, tagged by a leading letter:

  • lines beginning W hold SMB credentials — a username and password for a scan-to-folder profile
  • lines beginning V hold the SMB path each profile scans into
  • lines beginning U hold user codes
  • lines beginning E hold address entries (named contacts)

The username and password fields are base64-encoded, not encrypted — once the payload is decrypted, unwrapping them is a single decode step. That is the whole reason a recovered backup exposes working credentials.

Why this matters

The device is protecting the payload against casual inspection, not against someone who holds the backup file and the (often blank) password. For a forensic examiner or an authorized auditor, that means a single exported file can reveal the service accounts a fleet of printers uses to write onto file shares. See recovering SMB credentials in forensics for why that is significant, and how to export the backup to get one.

Decode a file