Analysis of PowerPo...
 
Notifications
Clear all

Analysis of PowerPoint files  

  RSS
todd_cooper
(@todd_cooper)
New Member

Is anyone aware of a way to determine when individual slides within a .pptx file were created or modified? Or if there’s a way to determine which slide was modified last?

I'm examining a .pptx file that shows a created date in 2012 and a last modified date in 2017. If i can determine that certain slides were modified in 2017, it could determine the outcome of the case.

I've examined the file in X-Ways, but am not finding anything that would identify the modification date of individual slides.

I've been searching the internet but still coming up short.

Any thoughts would be greatly appreciated.

Quote
Posted : 30/10/2018 2:56 pm
giandega
(@giandega)
Active Member

Try to remake file in .zip then uncompress it

ReplyQuote
Posted : 30/10/2018 3:25 pm
tootypeg
(@tootypeg)
Active Member

Im going to stick my neck out after having done some quick (maybe even horrible, certainly not exhaustive) testing on some pptx files just this second - this metadata doesn't exist for pptx files.

***come at me guys, prove me wrong lol lol 😯 D **

ReplyQuote
Posted : 30/10/2018 4:19 pm
DCS1094
(@dcs1094)
Active Member

Have you checked for any Volume Shadow Copies (VSC/VSS) and if so, any previous versions of the .pptx file? Then you could review each of those versions for changes in slides. Just a thought…

ReplyQuote
Posted : 30/10/2018 10:39 pm
Passmark
(@passmark)
Active Member

I agree looking for old versions of the same file is best solution. Maybe an old copy was sent in EMail and remains as an attachment. Or if they keep full disk backups?

Also as already pointed out. PPTX files are Zip files. So if you unzip the file you will find a core.xml file with some date metadata. But not for each slide.

Core.xml
=====
Title Text
Creator Author Name
Update Author Name
1
2018-10-31T051447Z
2018-10-31T051506Z

Also there is an XML file per slide, slide1.xml, slide2.xml, etc… These contain a little bit of meta data. Like the Schema used.

For example,
schemas.microsoft.com/office/drawing/2014/main" id="{E07D1542-70BC-4CB0-A1A2-A0F63287B7A6}"/>

Would be hard to imagine how a 2014 scheme could be used in 2012. You might get very lucky and these might be preserved per slide. But I doubt it.

Also there is another meta data. Like the language. In my case I see this,
lang="en-AU"
Which is for Australian English. This seems to be set per slide.

So you might get really lucky and have different languages in use for the original document and the 2017 edit. Kind of clutching at straws however.

What about Office Telemetry?
https://www.osdfcon.org/events_2018/microsoft-office-telemetry-tracking-your-every-move/

ReplyQuote
Posted : 31/10/2018 5:42 am
Share: