Difference between pages "1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d" and "Microsoft Office"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
m
 
(External Links)
 
Line 1: Line 1:
1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d is the SHA-1 for a block of 4096 NULL bytes:
+
{{expand}}
  
 +
== EventLogs ==
 +
As of Office 2010 related Office Alerts EventLog:
 
<pre>
 
<pre>
$ dd if=/dev/zero of=4k bs=4096 count=1
+
C:\Windows\System32\winevt\Logs\OAlerts.evtx
1+0 records in
+
1+0 records out
+
4096 bytes transferred in 0.000059 secs (69273666 bytes/sec)
+
$ sha1 4k
+
filename  size                    SHA1                 
+
========================================================
+
4k  4096  1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d
+
 
</pre>
 
</pre>
 +
 +
== See Also ==
 +
* [[Microsoft Office File formats]]
 +
 +
== External Links ==
 +
* [http://dfstream.blogspot.com/2014/01/ms-excel-2013-last-saved-location.html MS Excel 2013 Last Saved Location Metadata], Jason Hale, January 12, 2014
 +
 +
[[Category:Analysis]]

Revision as of 16:26, 13 January 2014

Information icon.png

Please help to improve this article by expanding it.
Further information might be found on the discussion page.

EventLogs

As of Office 2010 related Office Alerts EventLog:

C:\Windows\System32\winevt\Logs\OAlerts.evtx

See Also

External Links