Hi I am analizing with an hex editor a .doc file. Can I see in the analisis if the document was print and identify the kind of printer (for example, HP, Epson)?
Is this possible?
Thanks
Patricia
Patricia,
You will want to research the term metadata. There is quite a bit of information stored by MS Office apps in metadata. Harlan Carvey has some excellent information on his blog about looking at metadata if you do not have any of the commercial tools such as MetaData Assistant from Payne Consulting.
Thanks. I forgot say than I am using WinHex Forensics for my analisis, but I will see your suggestions.
Best Wishes
Patricia
I did a quick test with a new document and printed it. I noted no printers referenced when using a hex editor. MetaData Assistant is available as a trial software so you may wish to try it out. It is a great tool and reasonably priced if you need to examine a large number of documents.