Hi, I am using EnCase forensic 6.18 and have located what seems to be 3 documents and a numbers of images through their signatures on a formatted disk. The 3 docs are password protected - but when I double click on one of the images I have bookmarked - a dialog appears indicating this "has a Compound Document File signature" - when I view anyway it tries to open a word doc. Does this indicate that the image is embedded in the document? The problem with it being embedded is when I extract the word doc there is no image within.
Thanks
Google compound document file signature. Compound Documents are well err..documented?
They are on forensics wiki as well
I am assuming that by "documents" you are referring to MS Office documents and the reference to "Compound Document" indicates that you are looking at files created with Office 2003 or earlier.
If this is true then take a look at "[MS-CFB] Compound File Binary File Format"
http//
I would suggest exporting the file out of EnCase and using a hex editor to review the file.
Feel free to ping me offline if you need anymore.
Alan
…when I double click on one of the images I have bookmarked…
How have you bookmarked the items? If its an embedded image in the document that and you have swept an image header and bookmarked it as a picture then it will try to open the document, not the picture. This is because you have actually created the bookmark in the document, so thats what it will try to open when you double click.
If you want to take the picture out as a picture then you will need to export it as Spawn has suggested. In the tex/hex view sweep the entire picture and then right click and export the highlighted section as an image.
Thanks guys
I'll give that a whirl
regards
Stevie