Difference between revisions of "PowerPoint Presentation (PPT)"

From Forensics Wiki
Jump to: navigation, search
m (File signature)
 
Line 9: Line 9:
 
[[Microsoft PowerPoint]] presentation of version 97-2003 use the [[OLE Compound File]] (OLECF). These files therefore have the OLECF file signature
 
[[Microsoft PowerPoint]] presentation of version 97-2003 use the [[OLE Compound File]] (OLECF). These files therefore have the OLECF file signature
  
The object stream of the OLECF containing a PowerPoint presentation contains the string "..." with some version.
+
The object stream of the OLECF containing a PowerPoint presentation contains the string "PowerPoint Document" with some version.
  
 
== PowerPoint 97-2003 presentation ==
 
== PowerPoint 97-2003 presentation ==

Latest revision as of 11:55, 5 June 2009

The PowerPoint Presentation (PPT) file format has the .ppt extension. This file type originates from Microsoft PowerPoint. However, other presentation software can be used to display these files as well. These include:

Contents

MIME types

File signature

Microsoft PowerPoint presentation of version 97-2003 use the OLE Compound File (OLECF). These files therefore have the OLECF file signature

The object stream of the OLECF containing a PowerPoint presentation contains the string "PowerPoint Document" with some version.

PowerPoint 97-2003 presentation

The PowerPoint 97-2007 Binary File format is stored in the OLECF using multiple streams:

  • ... stream

Encryption

See Word Document (DOC). Note: perhaps this section should be moved to a separate section about Microsoft Office encryption

See Also

PowerPoint 97-2007 Binary File format by Microsoft