Hi everyone,
I was asked this question from my boss earlier and not sure of the answer.. Hoping some of you can chime in with some replies )
They would like to know if it would be possible for someone to restore deleted information in an Excel file (either through Excel or by using some other software to manipulate the file)?
I think the answer would be no, but I'm not sure what Microsoft has done lately and maybe some of the deleted data can still be found in the file somewhere…
Thanks!
Akira
Which Excel version?
Which actual saved format?
(the above is for the "lately")
The answer is NO.
AFAIK there may be security issues with
- crashed Excel (leaving behind a corrupted file)
- temp files
- deleted files (like user "saving as" and then deleting the file - but this is a generic filesystem issue)
- "live" imaging (imaging the RAM)
but nothing remains in the actual file.
jaclaz
Thanks for the response jaclaz…
We are looking at Excel versions 2007, 2003, XP, and I think even 97 is still used in places.
The actual saved format is XLS/XLSX
Agree with jaclaz. Any backups available?
Also, if you're looking at specific file which was transmitted in Outlook then you might get lucky by looking in Temporary Internet Files - typically in a folder beginning "OLK".
Best of luck!
No backups available… just that 1 file with no temporary files available either.
I did some testing with EnCase and it really doesn't look recoverable…
Thanks for the responses!
Some MS Office programs (depending on the version) tend to place the data on disk in various temporary files whilst you are editing the current version. As such, there may be copies of the current (and earlier versions) in the form of temporary files.
I've had a
amount of success with the following methodology
1) Identify some text in the current document that looks like it has been there since the document was first created (column headers in a spreadsheet for example). A good candidate for this operation is text that is unlikely to turn up in the rest of the machine, something that is unique to this file
2) Identify where this text appears in 'hex' view
3) Do a hex grep search for this text (and any control characters around and within the text too) in free, unallocated, slack (or whatever else you want to call it), space. You might want to search deleted files too.
4) Hopefully your search will find all fragments of temporary or previous incarnations of this document.
Good hunting, and above all, be lucky!
Paul
For fun, change the extension of the XLSX file to ZIP and open to see the XML files. It will help you understand the way these compound files work to better explain what can an cannot be done.
This can be done on DOCX, PPTX, etc as well for the newer MS Office formats. Older < 2003 are also compound files but structured differently and worth understanding as well.