Hi,
Â
I'm going to be frank here. I'm a layperson that needs your help. I'm working as an investigative journalist for a newspaper and have obtained an excel file that is crucial to a story I'm going to write.Â
To determine the integrity of the data, I need information about a specific cell/line in the file. Ideal would be to see which user last edited the cell, otherwise it would also be useful to determine when the cell was last edited. The document was shared amongst many people, who jointly edited it. Track changes seems not to be enabled.
Is this at all possible? Can I do it myself? I'd also be open to hire a forensics expert if he could do the task.
My skill level: I can work with command line on linux and am decently familiar with Python. Unfortunately I have no experience regarding forensics.
Thank you very much for your help.
Is this at all possible?
No.
That would imply that the Excel file would keep a last accessed date/time and a last modified user field for each cell.
This info is simply not available, and (assuming that it is a .xlsx file) if it was created/modified by Microsoft Office you cannot even check the dates of the internal .xml files, as they will be all set to 1 January 1980:
https://core.ac.uk/download/pdf/36736439.pdf
This:
https://ntnuopen.ntnu.no/ntnu-xmlui/bitstream/handle/11250/198656/EDidriksen.pdf?sequence=1
is a pretty good overview of the file format and on what you may find in it.
jaclaz
Have 2 relevant questions for you;
- How was the document shared?
- What file type is it? xls or xlsx?
