Free Office Document Forensics

Read the package before the properties

A modern Office document is a zip archive, and the archive remembers how it was written. Word, Excel and PowerPoint write their parts in a fixed order, compress every entry the same way and set every entry timestamp to the same unset value, so a package whose entries sit in a different order, carry real timestamps that differ from one another or mix compression methods was written or rewritten by something other than the application named in its properties. The check lists every entry with its declared and compressed size, its method, its stored timestamp and the zip writer fields, verifies each checksum it decompresses, reads the content types and the relationships that bind the parts together and reports any part the package declares but does not contain.

None of that proves an edit. A document saved through a document management system, a mail gateway or a conversion service can carry the same signs honestly. It tells you which application last packaged the file, which is the first question to settle before anyone argues about what the text says, and when the answer matters to a deadline a senior examiner can tell you on a free first call what else to ask the custodian for.

Read the properties the application wrote

The core and application properties are the document's own account of its history: who created it, who last saved it, when it was created, modified and last printed, how many times it was saved, how many minutes it was open for editing, which application and version saved it, which template it began from and which company name the installation carried. The check reads every one of them and then reads them against each other and against the package. A modified date before the created date, total editing time longer than the span between the two, a revision count that does not fit the editing sessions in the text, a last printed date after the last save, package timestamps that postdate the properties or properties that are missing altogether each appear as an observation in plain words, with the values that produced it.

Properties are statements, not measurements. A template keeps its creation date, a copy saved under a new name keeps its author, and a scrubbing tool removes everything, so the report says what the fields contain and where they disagree and leaves the explanation to the custodian and the examiner.

Count the editing sessions behind the text

Every time Word opens a document and the text changes, it assigns the session a revision save identifier and stamps the paragraphs and runs that session touched. The identifiers accumulate across the life of the document and are listed in its settings. The check reads them all: how many sessions produced the text, which runs belong to which session and how many characters each contributed, the root identifier the document started from, and any identifier that appears in the text but not in the settings list, which is how text pasted from another document or merged from another copy gives itself away.

A document that claims one author and one save but carries forty sessions, or a contract whose disputed clause belongs to a session nothing else in the document shares, is a document to examine further. The identifiers do not name people or dates, and a document that has passed through another application can lose or renumber them, so the session count is a lead for the examination, not a history of who wrote what.

Find what was meant to be deleted

Tracked changes carry the author and the time of every insertion and deletion until someone accepts them, and comments carry their authors, initials and dates until someone removes them. Both leave remnants that survive the act of cleaning up: the people part that still names every commenter after the comments are gone, the extended comment records, the formatting change markers, hidden text and the document variables and custom properties a document management system wrote.

The check reports every tracked change by author and date, every comment and its author, every person named in the people part and every hidden run, and for a workbook or presentation the threaded comment authors and legacy comment authors as well. Remnants are observations about what the file still contains, not findings about intent.

Look for what the reader was not meant to see

A workbook hides content in three places and the check reads all of them: sheets marked hidden or very hidden, which only a macro or the object model can reveal, rows and columns marked hidden on every sheet, and defined names marked hidden or pointing outside the workbook. It reads the file version record that names the application that last edited the workbook and the one that first created it, the protection flags and any revision log left by shared workbook tracking.

A presentation hides slides with a single attribute and carries speaker notes the audience never saw, and the check lists the hidden slides, every slide with notes and the character count of each, and compares the hidden slide count the application recorded against the slides it finds. Hidden content is a question to put to the author before it is anything else.

Name the objects, macros and links without opening them

Embedded objects, linked files, macros and hyperlinks are where a document reaches outside itself. The check lists every embedded object with its declared type, its size and the format its first bytes actually declare, names every macro module from the project record inside the macro container without extracting, decompressing or running any code, lists every relationship that points outside the package, including linked images, linked objects, attached templates, external workbook references and data connections, and lists the hyperlinks in the text with their targets.

A macro enabled document whose project names a module nothing in the document uses, an attached template on a network path, or a link to a file share that no longer exists each tell counsel something about where the document has been. When one of those matters to a matter, a full examination by an examiner is the next step, and computer forensics begins with preservation of the source.

Your files and reports remain local

The selected document, its file name, hash, entries, properties, text statistics, notes and report data never reach a server. Optional usage measurement stays off unless you allow Analytics. With permission it sends GDF only the tool name and fixed action labels, such as analysis completed or report prepared, never an input, result, filename or visitor identifier. Google and advertising scripts do not load on this page. Use Cookie settings below to change your choice. Program files, the zip reader and fonts download from this website; nothing about your document travels with them.

Clear cancels active work and removes the displayed records without deleting your original or any report you saved. Saved reports can contain private file names, author names, hashes and notes; review them before sharing.

Save the report

Download the PDF or HTML report in the Global Digital Forensics four section layout: the executive triage and file identity with the full SHA 256, the plain English interpretation guide, the structured findings inventory with every observation located in the package and your notes, and the evidentiary scope advisory with the beta notice. The Excel ready CSV gives one column per field and the JSON is the lossless record of the hash, every package entry, the content types and relationships, every property, the session table, the change and comment records, the hidden content inventory, the object, macro and link records and the coverage statement. No report contains the document text itself beyond the snippets the observations quote.

Formats and resource requirements

Each document is limited to 64 MiB, each package entry to 64 MiB when decompressed and the package to 4,096 entries. XML parts are scanned up to 64 million characters each, the text statistics stop at 4 million characters of document text, and the operation time limit is 120 seconds. Limits stop work with an explanation rather than a shortened result.

Coverage is recorded, not assumed

Every result states what it examined. The package layer records how many entries it listed and how many it decompressed and verified, each parsed part records whether it was read in full, and every unavailable layer records the reason. Detection of edited documents has not been measured by GDF against a reference set, so an unavailable, cancelled or quiet result is unknown rather than a finding that the document is what it claims to be.

Properties and package structure are never relied on in isolation. Keep the original and its collection context, work on copies, and bring the observations that matter to a case to an examiner who can test them against the source system and its logs. Tell us about a problem with the tool; the link attaches no selected file or report.

Related tools and methods

Metadata Analyzer reads the properties of a wider range of files through ExifTool and Metadata Comparison sets two to four copies of the same document side by side to show which fields and bytes changed; reselect your document there, because inputs are never placed in links. When a matter turns on who wrote or changed a document, expert witness services begin with a full examination of the source system.

Versions and methods

The package reader follows the Office Open XML specification published as ECMA 376, the Open Packaging Conventions in its second part, the ZIP file format specification maintained by PKWARE, and the Microsoft Compound File Binary and Office VBA file format documents for the macro container. Decompression uses fflate. These references describe the formats; they do not certify this tool. Version 1.0.0 beta. All free tools.