±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 0 Overall: 36775
New Yesterday: 0 Visitors: 96

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Carving Office 2007 docx and dotx files

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts

Senior Member

Carving Office 2007 docx and dotx files

Post Posted: Dec 17, 09 01:37

I am carving out Office 2007 documents which are basically Zip files. I have managed to tell the difference between Word and Excel from the files contained in the Zip. I then ran into a problem, various files would not open. They were valid Zip files, with a valid length, ending with a string PK 0x05 0x06 ....

Eventually, I discovered they were template files which opened in Word if I set the extension to dotx (or xltx for Excel).

Looking at the xml files I cannot see where this information is stored.

Can anyone guide me as to where I can find this information?


Page 1 of 1