Sunday, February 2, 2014

Daily Blog #224: Sunday Funday 2/2/14

Hello Reader,
            If you watched the forensic lunch this week you heard Ian Duffy talking about his work looking into the structures of Microsoft Office documents. There are many times in my career where an investigation can become centered on now only when a document was accessed but; what was done with it, what computer did it come from, who edited it, etc... This week let's see how many different sources of forensic facts you can determine from Microsoft Office documents.

The Prize:
A $200 Amazon Gift Card




The Rules:
  1. You must post your answer before Monday 2/3/14 2AM CST (GMT -5)
  2. The most complete answer wins
  3. You are allowed to edit your answer after posting
  4. If two answers are too similar for one to win, the one with the earlier posting time wins
  5. Be specific and be thoughtful 
  6. Anonymous entries are allowed, please email them to dcowen@g-cpartners.com
  7. In order for an anonymous winner to receive a prize they must give their name to me, but i will not release it in a blog post

The Challenge:
List for each of the following document types and versions what forensic facts you can determine about a users past interactions with it. Please make sure to state which version of Office the fact can be derived from.
Doc
Xls
PPT
Docx
Xlsx
PPTx