Office Open XML Hacking
Office Open XML
Well maybe not exactly hacking, but I have just found bug/feature which able to recover EXIF/Metadata information from images inserted into MS Word 2007/2010 documents.
There was revolutionary change made by Microsoft to use Office Open XML format instead of old doc/xls/ppt. The Office Open XML file formats are files that actually are a ZIP-compatible packages containing XML text documents and other files and resources.
What is Computer Forensic application?
If there are images placed in office document we would like to check its EXIF and Meta information to find some interesting information and potential traces. It wasn’t possible in old formats but now to export EXIF/META information about images and other files placed inside docx documents you just have to:
- Rename docx extention into zip
- Open zip file, find images in folder /word/media/
- Use any proper tool to view and export EXIF information
As the Office Open XML is becoming standard in electronic documents, I am sure this simple knowledge will be used by forensic investigators often.
Category Article Computer forensics posts, tutorial
