-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > -----Original Message----- > From: stephen_larsonat_private > [mailto:stephen_larsonat_private] Sent: Sunday, May 25, 2003 > 1:55 AM > To: forensicsat_private > Subject: linking a word document to a computer > > > > > Hello, > Is there a way to link a word (or other MS Office) document to a > particular computer? I've heard that each installation of MS > Office is serialized, and that each doc created has that serial # > embedded in its meta-data, but have yet to be able to find it. > Thanks. > Steve I guess you're thinking about pid_guid. This is supposed to have been removed in versions of Office beginning with 2000 and up. Warren G. Kruse II and Jay G. Heiser have some good info on it in their book "Computer Forensics - Incident Response Essentials" (ISBN 0-201-70719-5). It will also be covered in a paper I'm writing on Windows investigation basics. Getting the book will probably be faster than waiting for me to finish though ;) Best Wishes, Tom Erik Engeskaug - -- tomerik.engeskaugat_private or tomerikat_private PGP key available on request -----BEGIN PGP SIGNATURE----- Version: PGP 8.0 - not licensed for commercial use: www.pgp.com iQA/AwUBPtI25wB/tZom2kDIEQLyggCgzdzlG9RtlhWzR82YDVV1zy/hyR0An3je zPpXR2wrS583y2JfkvtSYvNJ =xrW0 -----END PGP SIGNATURE----- --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.483 / Virus Database: 279 - Release Date: 19.05.2003 ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Mon May 26 2003 - 11:48:30 PDT