Hope someone can help me out.
I'm trying to recover deleted Microsoft Works spreadsheet files on a MAC. Neither EnCase nor X-Ways seems to have Works files in their signature list.
Does anyone know what the header/footer for these files looks like?
Thanks in advance…..
cfprof,
I've never worked with works spreadsheets but downloaded a couple off the net (.wks) and the three I picked up all have bytes 0-7 as
00 00 02 00 04 04 06 00
The last few bytes of the files are all
01 00 00 00
Far from definative so maybe download a few and test as I don't know if there are version differences etc or not
Andrew
I stand corrected as lotus also uses the same extension the headers in the previous post seem to belong to lotus 123 files.
Works spreadsheets that I downloaded look to have a header of
FF 00 02 00 04 04 05 54
The footer is the same as in the original post.
Thanks Andrew!
Can't believe I didn't think to try to download some. I kept looking for a signature table somewhere out there on the web.
I'll check to see if this agrees with what I thought I saw.
Again, thanks for the tip.
