Carving Office 2007...
 
Notifications
Clear all

Carving Office 2007 docx and dotx files

1 Posts
1 Users
0 Likes
596 Views
(@mscotgrove)
Posts: 938
Prominent Member
Topic starter
 

I am carving out Office 2007 documents which are basically Zip files. I have managed to tell the difference between Word and Excel from the files contained in the Zip. I then ran into a problem, various files would not open. They were valid Zip files, with a valid length, ending with a string PK 0x05 0x06 ….

Eventually, I discovered they were template files which opened in Word if I set the extension to dotx (or xltx for Excel).

Looking at the xml files I cannot see where this information is stored.

Can anyone guide me as to where I can find this information?

Michael

 
Posted : 17/12/2009 12:37 am
Share: