Quoted from Microsoft's website: "The Microsoft Office binary file format documentation was removed from the MSDN in 1999. If you would like to receive this documentation, you can send e-mail to officeffat_private, or mail to: Office File Format Documentation Request One Microsoft Way Redmond, WA 98052 Requests should contain a detailed description for planned use of this documentation." Microsoft Office files are what Microsoft calls "compound documents", meaning that there is a lot of information embedded in the file (e.g. author, summary, date, etc) These fields can be easily read: http://support.microsoft.com/directory/article.asp?ID=kb;en-us;Q186898 or modified: http://support.microsoft.com/directory/article.asp?ID=kb;enus;Q224351 Hope this helps. --Tony -----Original Message----- From: Nicole Haywood [mailto:N.Haywoodat_private] Sent: Thursday, September 13, 2001 10:58 PM To: forensicsat_private Subject: Forensics on Word Documents I've got to do a comparison on a couple of versions of word documents to try to determine which was created first etc. Is there anything any one can suggest I look at in a word document other than creation date and revisions etc. Thanks, Nicole -- Nicole Haywood Phone: +61 2 93515504 Network Security Officer Fax: +61 2 93515001 University of Sydney Email: N.Haywoodat_private ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Sun Sep 16 2001 - 22:57:35 PDT