±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 7 Overall: 36096
New Yesterday: 4 Visitors: 268

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

File Header for Word Documents - Dates & Times

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2  Next 
  

novadonuk
Member
 

File Header for Word Documents - Dates & Times

Post Posted: May 24, 06 14:11

Hi,

Im looking into a possible email harrasement case. And the email seems to have been editied in a word package.
The question is, can I possibly extract the date from the file header or not? As this is the major point I need help with ...

Look forward to receiving some feedback, Cheers.

ps, only have access to a DVD not HDD  
 
  

samr
Senior Member
 

Re: File Header for Word Documents - Dates & Times

Post Posted: May 24, 06 15:30

That is simply the file identifier which identifies the file as a Microsoft office/visio file that alone has no date or time information. Two things you could try:

1) Look for the footer: F4 39 B2 71 (00 00) and reconstruct the file simply examining the metadata contained.

2) If only a slither of information is still present then you may have to manually go through the hex looking for remaining metadata.  
 
  

arashiryu
Senior Member
 

Re: File Header for Word Documents - Dates & Times

Post Posted: May 24, 06 17:35

Extract MetaData for the word document.  
 
  

novadonuk
Member
 

Re: File Header for Word Documents - Dates & Times

Post Posted: May 24, 06 17:42

Can you explain how I interpret the metadata please? I am interested specifically in creation and modification dates for a raw file recovered during a header search. Is this data in a particular format, and if so where would I expect to see it, as part of the header, footer or somewhere else?

Regards  
 
  

samr
Senior Member
 

Re: File Header for Word Documents - Dates & Times

Post Posted: May 24, 06 17:58

Well the time stamps associated with files are slightly different, such information is held within the MFT (assuming NTFS). Assuming it's a file then you would need backtrack the location to the MFT.

In terms of metadata of word documents this includes creation date, last saved time, revision information etc. Something like Metadata Assistant should be able to help you easily interpret this.  
 
  

manuld
Member
 

Re: File Header for Word Documents - Dates & Times

Post Posted: May 24, 06 20:17

Do you have the word document or the email message? What type of email package is it?

If you have the document try here:

cert.uni-stuttgart.de/...00206.html  
 
  

arashiryu
Senior Member
 

Re: File Header for Word Documents - Dates & Times

Post Posted: May 24, 06 22:01

I have used metadata asst. successfully in the past. The output is reader friendly.

Please note that there are also programs that support metadata removel. Hopefully that was not run on the doc.  
 

Page 1 of 2
Page 1, 2  Next