Difference between pages "5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5" and "Microsoft Office"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
m (Created page with '5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 is the SHA1 of a block of 512 NULL bytes: <pre> $ dd if=/dev/zero of=512b bs=512 count=1 1+0 records in 1+0 records out 512 bytes transf…')
 
(External Links)
 
Line 1: Line 1:
5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 is the SHA1 of a block of 512 NULL bytes:
+
{{expand}}
  
 +
== EventLogs ==
 +
As of Office 2010 related Office Alerts EventLog:
 
<pre>
 
<pre>
$ dd if=/dev/zero of=512b bs=512 count=1
+
C:\Windows\System32\winevt\Logs\OAlerts.evtx
1+0 records in
+
1+0 records out
+
512 bytes transferred in 0.000054 secs (9502140 bytes/sec)
+
$ sha1 512b
+
filename  size                    SHA1                 
+
========================================================
+
512b  512  5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5
+
 
</pre>
 
</pre>
 +
 +
== See Also ==
 +
* [[Microsoft Office File formats]]
 +
 +
== External Links ==
 +
* [http://dfstream.blogspot.com/2014/01/ms-excel-2013-last-saved-location.html MS Excel 2013 Last Saved Location Metadata], Jason Hale, January 12, 2014
 +
 +
[[Category:Analysis]]

Revision as of 16:26, 13 January 2014

Information icon.png

Please help to improve this article by expanding it.
Further information might be found on the discussion page.

EventLogs

As of Office 2010 related Office Alerts EventLog:

C:\Windows\System32\winevt\Logs\OAlerts.evtx

See Also

External Links