Hi everyone.
When you delete a picture or logo within an existing PowerPoint document and save the document, are there ways to recover these changes or get evidence that this happened from the document itself (metadata)?
When analysing the computer, would temp files and maybe restore points be the option?
Cheers
Win7 or Vista? Shadow volumes perhaps.
The OS is unknown at the moment, could be Win XP as the document was created in 2006.
Thanks
I don't see a track changes option, as with MS Word, so I doubt that the changes will be recorded in the file. Each time that you save, the file should be rewritten in a lean way as to not leave trash in the file.
I have seen what I call object/stream slack in MS Office 2003 and earlier document format versions. This is similar to RAM slack that resides in the unused space of a sector following a file's content that doesn't fill the entire sector. This is different from file/disk slack that consists of unused sectors in the remainder of each cluster at the end of files.
In today's OSes, the RAM slack is typically zeroed out, but the OLE2 object slack often isn't. This slack typically consists of document fragments that were used to complete an OLE2 stream to fit into the standard stream sizes (normal & small sizes coexist in the same document) of the document. There could be deleted content in this slack, depending on how sloppy the software developers were in padding the remainder of the streams.
It might be easier, and more conclusive, to file carve the unallocated disk space for previous versions of the presentation.