Carving Office 2007 docx and dotx files
I am carving out Office 2007 documents which are basically Zip files. I have managed to tell the difference between Word and Excel from the files contained in the Zip. I then ran into a problem, various files would not open. They were valid Zip files, with a valid length, ending with a string PK 0x05 0x06 ….
Eventually, I discovered they were template files which opened in Word if I set the extension to dotx (or xltx for Excel).
Looking at the xml files I cannot see where this information is stored.
Can anyone guide me as to where I can find this information?