Re: Tracing MS Word documents

From: Seth Arnold (sarnoldat_private)
Date: Fri Jan 18 2002 - 12:19:27 PST

  • Next message: Valdis.Kletnieksat_private: "Re: Top Ten List!?"

    On Thu, Jan 17, 2002 at 09:14:50PM -0600, Nick Lange wrote:
    > If the file opens in word, then unless they know the structure of word files
    > [does anyone?], you can at least have a 90% assurance that nothing was added
    > or deleted to the file;
    
    Hence the requirement of "decent editor". As a direct example, vim -b.
    It won't modify the file size unless you specify to change the file
    size. Get in, find the MAC, use R to modify the bytes you don't like.
    
    With the GUID, the idea isn't to remove it as much as either put in
    bogus data, or a mess of zeros, or something like that -- overwriting
    the bytes directly.
    
    Unless MS has changed their file formats, they didn't bother with a
    checksum over this data.
    
    -- 
    "Soldiers quartered in a populous town will always occasion two mobs
    where they prevent one. They are wretched conservators of the peace."
    -- John Adams
    
    
    



    This archive was generated by hypermail 2b30 : Sun Jan 20 2002 - 08:29:36 PST