I lost access to a TrueCrypt volume from years ago, and using AWS GPU spot instances, I was brute forcing ~1000000 permutations every 40 seconds last night for $7/hr. The hardware is incredibly accessible.
If he was trying combinations using upper-case characters, lower-case characters, numbers, and let's say 20 symbols, that's 82 possible combinations for each one. We'd expect him to find the password after exhausting half of the search set, so we want log base 82 of 18B. That suggests 5 characters.
If he let's say just used lower-case characters and numbers, that's log base 36 of 18B, which suggests 7 characters.