… what are your recommendations? My boss wants me to do this job fast, and I don't have a tool for it, nor a budget to acquire one.
In case no free tools do the trick, what cheap ones do you recommend?
Thanks!
With hats off to cybercop on another forum, here's a link he provided to a possible solution
There are two free, open-source tools for this that are part of my book and included on the accompanying DVD.
can they be downloaded separately, or do I need to buy your book to get them?
Psst. I'd buy the book anyway, it's a great tool. But don't tell Harlan I said so.
I heard that they are on the DVD only, but I also heard that if folks contact the author directly, he used to be pretty good about providing the tools…until folks just didn't even bother to say so much as "thanks"…but that's just what I heard…
yeah, there are some rude people around, for sure (
Here's a couple of examples of the output of the author's tools
This one shows the output for Office docs (in this case PPT, but works on XLS)
http//
These talk about Word metadata
http//
http//
http//
Here's a good one on PDFs
http//
The guy who writes for this blog really seems to have some good stuff…
Please send an e-mail to computerforensics911@inbox.com. I have several resources that may help. One tool that I have used at a Dept. of Defense Organization was Document Detective $300.00. (30 Day Eval. )
Excellent Tool. Would highly recommend.
http//
Pinpoint MetaViewer-FREE
Pinpoint Metaviewer allows users to quickly extract file system metadata, OLE metadata contained in Microsoft Office Files and hash values all at the click of a mouse. Metaviewer allows computer forensic examiners and litigation support professionals often need to retrieve the metadata for specific files. Pinpoint Metaviewer is a right-click send-to utility that places the power of viewing metadata and hash values inside Windows Explorer. Once the information is retrieved users can paste all or selected fields into any application.
http//
Have some additional information and tools I can provide to anyone.
Jim
Just wanted to make sure that I am not going on a wild goose chase…
If I am given a Word document, and I want to find out what changes have been made to that document… can metadata provide me with this information? If no, what can, if anything?