Take the State of DFIR Survey Caseloads, AI, tools and careers. 8 minutes, anonymous, early access to the report.

Take the survey

Take the State of DFIR Survey

Caseloads, AI, tools and careers. 8 minutes, anonymous, early access to the report.

Take the survey →
Carving Office 2007...
 
Notifications
Clear all

Carving Office 2007 docx and dotx files

1 Posts
1 Users
0 Reactions
1,201 Views
(@mscotgrove)
Prominent Member
Joined: 18 years ago
Posts: 940
Topic starter   [#5053]

I am carving out Office 2007 documents which are basically Zip files. I have managed to tell the difference between Word and Excel from the files contained in the Zip. I then ran into a problem, various files would not open. They were valid Zip files, with a valid length, ending with a string PK 0x05 0x06 ….

Eventually, I discovered they were template files which opened in Word if I set the extension to dotx (or xltx for Excel).

Looking at the xml files I cannot see where this information is stored.

Can anyone guide me as to where I can find this information?

Michael



   
Quote

Enterprise Partners

  • atola-logo
  • celebrite-logo
  • semantics21 2026 FF logo
  • MagnetForensics_ForensicFocus

Partners

  • ADF
  • Logo_MSAB_Black (2)
  • detego-logo
  • Aid4Mail-Logo
  • logo Belkasoft 135x100
  • gmdsoft-logo

Academic Partners

  • University of Southampton logo 2
Share: