Re: Forensics on Word Documents

From: Nicole Haywood (N.Haywoodat_private)
Date: Wed Sep 19 2001 - 16:05:14 PDT

  • Next message: Tim Haynes: "Re: Forensics on Word Documents"

    Try running it with strings -a which tells it to look for ascii instead of unicode.
    
    BTW thanks everyone for their suggestions. And yes the windows strings utility came in very handy, as I didn't have access to unix to examine files.
    
    For those that are interested I am investigating a case of academic misconduct. Basically two students handed in the same assignment, and one is claiming the other student stole it, so I was trying to work out if there was any evidence in the word document itself which might indicate which student is telling the truth.
    
    Thanks again,
    
    Nicole
    
    At 14:10 19/09/01 +0000, you wrote:
    
    >Just downloaded Strings from sysinternals.  Very cool :)  
    >But I do have a question about it....
    >
    >Although it gives me lots of information about the file there still seems
    >to be lots of information missing.  Such as the actual text of the
    >document.  Also, I believe that the printer that the document was defaulted
    >to print to is also included as part of the document.  So question
    >is....where's the rest of the stuff??
    >
    >Thanks,
    >Barry 
    
    
    --
    Nicole Haywood                          Phone: +61 2 93515504
    Network Security Officer                Fax:   +61 2 93515001
    University of Sydney                    Email: N.Haywoodat_private
    
    
    -----------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Wed Sep 19 2001 - 17:45:21 PDT