Binary files format...
 
Notifications
Clear all

Binary files format of MS OFFICE

4 Posts
3 Users
0 Reactions
436 Views
Pato1960
(@pato1960)
Active Member
Joined: 18 years ago
Posts: 6
Topic starter  

Hello. I need the binary files format of ms office (files .doc, .xls. etc.in order to analize its structure with an hexadecimal editor. I am introducin myself in forensic computer analisys. Thank you
Patricia


   
Quote
(@bithead)
Noble Member
Joined: 20 years ago
Posts: 1206
 

Is this what you need?

What you are asking about is file signature/file header info. This is data that the normal user does not normally see. All you need to do is open the file with a hex editor and view the hex code. The first part of the file is a unique code which identifies what kind of file it is. The file signature for Microsoft Office is D0 CF 11 E0 A1 B1 1A E1 at offset 512 or 200 hex is a sub file signature that indicates if it is a word, powerpoint, excel document.

http//i243.photobucket.com/albums/ff59/mrodriguez239/PublicWebImages/MicrosoftFileSignature.jpg
In the link above is a screen shot of a word document in a hex editor and the file signature is highlighted in red.

www.garykessler.net/library/file_sigs.html
This link is a list of very common file headers. If you don't find the header info here then I would suggest searching google for file signature.


   
ReplyQuote
Pato1960
(@pato1960)
Active Member
Joined: 18 years ago
Posts: 6
Topic starter  

Thanks for your answer! I find this information very usefull to begin with and I would really appreciate if you could send me more.

Furthermore, I have already asked Microsoft Team for the binary files format of MS OFFICE and they are suppossed to send them to me.

I will send them to you as well.

Best wishes,

Patricia.


   
ReplyQuote
(@cosimo)
Eminent Member
Joined: 19 years ago
Posts: 20
 

Hi,

a great source of information for file formats (and not just signatures) is http//www.wotsit.org
You can find some other information sources on the Forensics Wiki (http//www.forensicswiki.org).
Good luck!!


   
ReplyQuote
Share: