Difference between revisions of "Word Document (DOC)"

From ForensicsWiki
Jump to: navigation, search
 
 
(24 intermediate revisions by 7 users not shown)
Line 1: Line 1:
 +
The '''Word Document (DOC) file format''' has the '''.doc''' extension. This file type originates from [[Microsoft Word]]. However, other word processing software can be used to display these files as well. These include:
 +
* [[WordPad]]
 +
* [[WordPerfect]]
 +
* [[OpenOffice]]
 +
* [[AbiWord]]
  
== DOC File Format ==
+
The Word DOC file format should not be confused with [[DOCX]].
  
DOC or Document file format usualyl has the .doc extension. Mostly these documents belong to Microsoft Word software files. However other word editing software can be used to execute these files including WordPad or WordPerfect. This file format contains the following MIME types:
+
== MIME types ==
+
 
- application/msword  
+
The following [[MIME types]] apply to this [[file format]]:
- application/doc  
+
 
- appl/text  
+
* application/msword  
- application/vnd.msword  
+
* application/doc  
- application/vnd.ms-word  
+
* appl/text  
- application/winword  
+
* application/vnd.msword  
- application/word  
+
* application/vnd.ms-word  
- application/x-msw6  
+
* application/winword  
- application/x-msword  
+
* application/word  
- zz-application/zz-winassoc-doc
+
* application/x-msw6  
 +
* application/x-msword  
 +
* zz-application/zz-winassoc-doc
 +
 
 +
== File signature ==
 +
 
 +
[[Microsoft Word]] documents of version 97-2003 use the [[OLE Compound File]] (OLECF). These files therefore have the OLECF file signature
 +
 
 +
The object stream of the OLECF containing a Word document contains the string "Word.Document" with some version.
 +
 
 +
== Word 97-2003 documents ==
 +
 
 +
The Word Binary File format is stored in the OLECF using multiple streams:
 +
* WordDocument stream
 +
* Table stream (0Table, 1Table)
 +
* Data stream
 +
 
 +
== Encryption ==
 +
 
 +
Versions 97/2000 encrypt documents with a very weak algorithm. This password scheme can be broken easily by several different products and it is possible to decrypt the contents without discovering the password. This is done by testing all 1,099,511,627,776 possible keys. Ultimate Zip Cracker by VDGSoftware is one utility that can perform this decryption.
 +
 
 +
== Extracting Strings ==
 +
 
 +
On a unix-like machine try this command to extract strings from a .doc file:
 +
 
 +
<code>
 +
cat /tmp/test.doc | tr -d \\0  | strings | more
 +
</code>
 +
 
 +
(where /tmp/test.doc is the path to your .doc file)
 +
 
 +
Note that a Word 97 and later document can contain both extended ASCII with codepage 1252 (codepage 1252 compressed text) and UTF-16 little-endian text. Word document can also contain 'East Asian' or 'Complex script' languages. Also the text stream contains information about all the parts of the Word document (header/footer, foot/endnote, annotation, etc.)
 +
Therefore using basic Unix string is very rough approach of finding data in a Word document. Use the wvtools or more sophisticated tools instead.
 +
 
 +
== External Links ==
 +
* [http://download.microsoft.com/download/0/B/E/0BE8BDD7-E5E8-422A-ABFD-4342ED7AD886/Word97-2007BinaryFileFormat(doc)Specification.pdf Word 97-2007 Binary File Format by Microsoft]
 +
 
 +
 
 +
[[Category:File Formats]]

Latest revision as of 01:17, 11 August 2012

The Word Document (DOC) file format has the .doc extension. This file type originates from Microsoft Word. However, other word processing software can be used to display these files as well. These include:

The Word DOC file format should not be confused with DOCX.

MIME types

The following MIME types apply to this file format:

  • application/msword
  • application/doc
  • appl/text
  • application/vnd.msword
  • application/vnd.ms-word
  • application/winword
  • application/word
  • application/x-msw6
  • application/x-msword
  • zz-application/zz-winassoc-doc

File signature

Microsoft Word documents of version 97-2003 use the OLE Compound File (OLECF). These files therefore have the OLECF file signature

The object stream of the OLECF containing a Word document contains the string "Word.Document" with some version.

Word 97-2003 documents

The Word Binary File format is stored in the OLECF using multiple streams:

  • WordDocument stream
  • Table stream (0Table, 1Table)
  • Data stream

Encryption

Versions 97/2000 encrypt documents with a very weak algorithm. This password scheme can be broken easily by several different products and it is possible to decrypt the contents without discovering the password. This is done by testing all 1,099,511,627,776 possible keys. Ultimate Zip Cracker by VDGSoftware is one utility that can perform this decryption.

Extracting Strings

On a unix-like machine try this command to extract strings from a .doc file:

cat /tmp/test.doc | tr -d \\0 | strings | more

(where /tmp/test.doc is the path to your .doc file)

Note that a Word 97 and later document can contain both extended ASCII with codepage 1252 (codepage 1252 compressed text) and UTF-16 little-endian text. Word document can also contain 'East Asian' or 'Complex script' languages. Also the text stream contains information about all the parts of the Word document (header/footer, foot/endnote, annotation, etc.) Therefore using basic Unix string is very rough approach of finding data in a Word document. Use the wvtools or more sophisticated tools instead.

External Links