You don't mention; * Word version * How you are examining the files * Exactly what and why you are wanting the information you are (without quoting specifics) At first glance, time and date stamps would be your best bet! Take note that some network Server OS's (some versions of NETWARE for example) are known to record date/time stamps incorrectly. To help build a timeline for a document I would examine the machine(s) where the document(s) were created, modified or read. If you don't know what machine a document was created on, then you can; * depending on your version and sp of Word/Office, locate the documents imbedded PID_GUID that can help identify the machine it was created on. * Examine the file with a forensic tool or a Hex Editor and find UNICODE text that details autorecovery paths and document paths. If you have access to the machine(s) the docs were created/modified on, I would then look there for supporting evidence of document creation/modification (TMP, LNK files etc). Other associations, such as when/if the document was printed etc. This can all help put together a timeline for the documents in question and help you in your inquiry. I hope this helps, Regards Simon Wellborne BTW: I would all be grateful if any private posts to you were forwarded back to the group. - -----Original Message----- From: Nicole Haywood [mailto:N.Haywoodat_private] Sent: Friday, 14 September 2001 5:58 p.m. To: forensicsat_private Subject: Forensics on Word Documents I've got to do a comparison on a couple of versions of word documents to try to determine which was created first etc. Is there anything any one can suggest I look at in a word document other than creation date and revisions etc. Thanks, Nicole -- Nicole Haywood Phone: +61 2 93515504 Network Security Officer Fax: +61 2 93515001 University of Sydney Email: N.Haywoodat_private ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Sun Sep 16 2001 - 22:55:21 PDT