±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 2 Overall: 36228
New Yesterday: 5 Visitors: 192

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Investigating Originality of a Document

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page Previous  1, 2 
  

pcook8198
Member
 

Re: Investigating Originality of a Document

Post Posted: Oct 22, 19 14:00

OLE style document consist of in basic terms Large Fat clusters and mini FAT clusters
Examination of these can also provide previous edits / Drive letter association / IP address / User accounts /

Previous edit time stamps and a whole raft more.

It was Tony Sammes and Brian Jenkinson who ran courses about this, its about 8yrs ago I attended a course and the specifics allude me as its being a long time since that course.Not using the skills on a regular basis has made me very rusty.  
 
  

jaclaz
Senior Member
 

Re: Investigating Originality of a Document

Post Posted: Oct 22, 19 15:48

- pcook8198
OLE style document consist of in basic terms Large Fat clusters and mini FAT clusters
Examination of these can also provide previous edits / Drive letter association / IP address / User accounts /

Previous edit time stamps and a whole raft more.

I see, thanks Smile , it is about the MS-CFB (OLE/OLE2) format, or "Structured Storage", I sometimes used this viewer:

www.mitec.cz/ssv.html

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 

Page 2 of 2
Page Previous  1, 2