ATTENTION: The new home of the Digital Forensics Wiki is at Yeah, it's a silly name, but it was cheap.
This wiki will be going offline permanently in the near future. An exact date will be announced soon. Thank you for being a part of this community.
If you wish to work on the new forensicswiki, please join the Google Group forensicswiki-reborn

PowerPoint Presentation (PPT)

From ForensicsWiki
Revision as of 16:55, 5 June 2009 by Wvanreij (Talk | contribs) (File signature)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

The PowerPoint Presentation (PPT) file format has the .ppt extension. This file type originates from Microsoft PowerPoint. However, other presentation software can be used to display these files as well. These include:

MIME types

File signature

Microsoft PowerPoint presentation of version 97-2003 use the OLE Compound File (OLECF). These files therefore have the OLECF file signature

The object stream of the OLECF containing a PowerPoint presentation contains the string "PowerPoint Document" with some version.

PowerPoint 97-2003 presentation

The PowerPoint 97-2007 Binary File format is stored in the OLECF using multiple streams:

  • ... stream


See Word Document (DOC). Note: perhaps this section should be moved to a separate section about Microsoft Office encryption

See Also

PowerPoint 97-2007 Binary File format by Microsoft