±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36583
New Yesterday: 6 Visitors: 167

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

File header for Microsoft Works (MAC)

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

cfprof
Senior Member
 

File header for Microsoft Works (MAC)

Post Posted: Jan 31, 07 20:37

Hope someone can help me out.

I'm trying to recover deleted Microsoft Works spreadsheet files on a MAC. Neither EnCase nor X-Ways seems to have Works files in their signature list.

Does anyone know what the header/footer for these files looks like?

Thanks in advance.....  
 
  

andy1500mac
Senior Member
 

Re: File header for Microsoft Works (MAC)

Post Posted: Jan 31, 07 21:25

cfprof,

I've never worked with works spreadsheets but downloaded a couple off the net (.wks) and the three I picked up all have bytes 0-7 as:

00 00 02 00 04 04 06 00

The last few bytes of the files are all:

01 00 00 00

Far from definative so maybe download a few and test as I don't know if there are version differences etc or not

Andrew
_________________
Andrew 
 
  

andy1500mac
Senior Member
 

Re: File header for Microsoft Works (MAC)

Post Posted: Feb 01, 07 01:31

I stand corrected as lotus also uses the same extension the headers in the previous post seem to belong to lotus 123 files.

Works spreadsheets that I downloaded look to have a header of:

FF 00 02 00 04 04 05 54

The footer is the same as in the original post.
_________________
Andrew 
 
  

cfprof
Senior Member
 

Re: File header for Microsoft Works (MAC)

Post Posted: Feb 01, 07 02:34

Thanks Andrew!

Can't believe I didn't think to try to download some. I kept looking for a signature table somewhere out there on the web.

I'll check to see if this agrees with what I thought I saw.

Again, thanks for the tip.  
 

Page 1 of 1