Analysis of PowerPo...
Clear all

Analysis of PowerPoint files  

New Member

Is anyone aware of a way to determine when individual slides within a .pptx file were created or modified? Or if there’s a way to determine which slide was modified last?

I'm examining a .pptx file that shows a created date in 2012 and a last modified date in 2017. If i can determine that certain slides were modified in 2017, it could determine the outcome of the case.

I've examined the file in X-Ways, but am not finding anything that would identify the modification date of individual slides.

I've been searching the internet but still coming up short.

Any thoughts would be greatly appreciated.

Posted : 30/10/2018 2:56 pm
Active Member

Try to remake file in .zip then uncompress it

Posted : 30/10/2018 3:25 pm
Active Member

Im going to stick my neck out after having done some quick (maybe even horrible, certainly not exhaustive) testing on some pptx files just this second - this metadata doesn't exist for pptx files.

***come at me guys, prove me wrong lol lol 😯 D **

Posted : 30/10/2018 4:19 pm
Active Member

Have you checked for any Volume Shadow Copies (VSC/VSS) and if so, any previous versions of the .pptx file? Then you could review each of those versions for changes in slides. Just a thought…

Posted : 30/10/2018 10:39 pm
Active Member

I agree looking for old versions of the same file is best solution. Maybe an old copy was sent in EMail and remains as an attachment. Or if they keep full disk backups?

Also as already pointed out. PPTX files are Zip files. So if you unzip the file you will find a core.xml file with some date metadata. But not for each slide.

Title Text
Creator Author Name
Update Author Name

Also there is an XML file per slide, slide1.xml, slide2.xml, etc… These contain a little bit of meta data. Like the Schema used.

For example," id="{E07D1542-70BC-4CB0-A1A2-A0F63287B7A6}"/>

Would be hard to imagine how a 2014 scheme could be used in 2012. You might get very lucky and these might be preserved per slide. But I doubt it.

Also there is another meta data. Like the language. In my case I see this,
Which is for Australian English. This seems to be set per slide.

So you might get really lucky and have different languages in use for the original document and the 2017 edit. Kind of clutching at straws however.

What about Office Telemetry?

Posted : 31/10/2018 5:42 am