A colleague is currently investigating a case involving an MS Excel 2003 file. The background to this case is that the Excel file in question contains data relating to the financial year 2006-2007. It is alleged that some cells in the spreadsheet were modified in late 2008 providing a backup story for the suspect's explanation of events. My colleague has been asked to verify if any file modifications in relation to the cells in question took place in 2008.
I know Office files record recent modification dates and who modified the file, and also that Tony Sammes runs a course at Shrivenham on document analysis, but would information to the level required be recoverable in theory?
Negative.
As you stated, you may be able to tell how many times the file has been "revised" and when the last editing occured and the name of the user account which performed the last editing as well as the last time it was printed, etc. based on file metadata, but you cannot [to the best of my knowledge] tell when an individual cell or sheet has been modified in a MS Excel Spreadsheet file.
Jeff
You might get lucky if 'Tracking Changes' was enabled. I think this stores a record of changes with dates they were made on and by whom. This may only be stored until the user accepts the changes, but I could be wrong.
Alternatively, what about backups from just before and after the period in question. You might be able to compare the differences in the file you have and the backup file.
Ronan
It seems like your question has been answered, but if you are at some point looking to compare excel sheets a great tool for that would be active data excel sheet comparison. Using this tool between sheets that have thousands of entries is great, it reports on the differences between the cells on seperate sheets.
Many thanks for your feedback gents, very useful.
A rather different approach. If the comapny did tape backups, does one exist for the period in question?
A rather different approach. If the comapny did tape backups, does one exist for the period in question?
Yes, this is being looked into. Thanks.