File header for Mic...
 
Notifications
Clear all

File header for Microsoft Works (MAC)  

  RSS
cfprof
(@cfprof)
Member

Hope someone can help me out.

I'm trying to recover deleted Microsoft Works spreadsheet files on a MAC. Neither EnCase nor X-Ways seems to have Works files in their signature list.

Does anyone know what the header/footer for these files looks like?

Thanks in advanceā€¦..

Quote
Posted : 31/01/2007 8:37 pm
andy1500mac
(@andy1500mac)
Member

cfprof,

I've never worked with works spreadsheets but downloaded a couple off the net (.wks) and the three I picked up all have bytes 0-7 as

00 00 02 00 04 04 06 00

The last few bytes of the files are all

01 00 00 00

Far from definative so maybe download a few and test as I don't know if there are version differences etc or not

Andrew

ReplyQuote
Posted : 31/01/2007 9:25 pm
andy1500mac
(@andy1500mac)
Member

I stand corrected as lotus also uses the same extension the headers in the previous post seem to belong to lotus 123 files.

Works spreadsheets that I downloaded look to have a header of

FF 00 02 00 04 04 05 54

The footer is the same as in the original post.

ReplyQuote
Posted : 01/02/2007 1:31 am
cfprof
(@cfprof)
Member

Thanks Andrew!

Can't believe I didn't think to try to download some. I kept looking for a signature table somewhere out there on the web.

I'll check to see if this agrees with what I thought I saw.

Again, thanks for the tip.

ReplyQuote
Posted : 01/02/2007 2:34 am
Share: