Timestamp on a part...
 
Notifications
Clear all

Timestamp on a partly recovered MS Office 2007/2010 document

2 Posts
2 Users
0 Reactions
407 Views
joakims
(@joakims)
Estimable Member
Joined: 15 years ago
Posts: 224
Topic starter  

I was wondering how one could identify the origin of a recovered part/fragment of a severely damaged MS Office 2007/2010 document (previously deleted and then partly overwritten. I know its possible to recover such fragments as long as at least the local file header (in zip structure) of the specific xml part is intact. I just started on a little application to do this. But the question is then, when such a part is recovered, how we may link this xml chunk to a timestamp. The problem is that MS Office don't update the timestamp in the zip structure, so unless you hit the actual xml where the timestamp is located, you have no way of knowing when it relates to?? Anyone knows?

I might add that it's possible to retrieve information from the rsid, rsidX and rsidRoot tags to connect the recovered part to a known document (with identical tags). But if the content of the xml differs from the known document it is from, we likely are not able to say when the modification was done??

Joakim


   
Quote
(@atheriot)
Active Member
Joined: 15 years ago
Posts: 6
 

In order for the document.xml file to list author and timestamp along with the revision tags, "Track Changes" has to be turned on. As far as I know, the core.xml file only keeps a revision count, created and last modified time, but no timestamps cross-referenced with revision IDs.


   
ReplyQuote
Share: