Word Document (DOC) - Revision history

Joachim Metz at 05:17, 11 August 2012

2012-08-11T05:17:19Z

Joachim Metz: /* Extracting Strings */

2010-01-16T20:50:26Z

‎Extracting Strings

Joachim Metz: /* Extracting Strings */

2010-01-16T20:40:08Z

‎Extracting Strings

Joachim Metz: /* Extracting Strings */

2010-01-16T20:39:05Z

‎Extracting Strings

Joachim Metz: /* Word 97-2003 documents */

2010-01-16T20:37:13Z

‎Word 97-2003 documents

Joachim Metz at 09:37, 31 January 2009

2009-01-31T09:37:16Z

Joachim Metz: /* File Header */

2009-01-31T09:32:20Z

‎File Header

Joachim Metz: Word (DOC) moved to Word Document (DOC)

2009-01-31T09:28:22Z

Word (DOC) moved to Word Document (DOC)

Joachim Metz at 09:25, 31 January 2009

2009-01-31T09:25:36Z

Joachim Metz: DOC moved to Word (DOC): There are multiple files with the doc extension

2009-01-31T09:06:20Z

DOC moved to Word (DOC): There are multiple files with the doc extension

@@ Line 38: / Line 38: @@
 Versions 97/2000 encrypt documents with a very weak algorithm. This password scheme can be broken easily by several different products and it is possible to decrypt the contents without discovering the password. This is done by testing all 1,099,511,627,776 possible keys. Ultimate Zip Cracker by VDGSoftware is one utility that can perform this decryption.
 == Extracting Strings ==
@@ Line 54: / Line 51: @@
 Note that a Word 97 and later document can contain both extended ASCII with codepage 1252 (codepage 1252 compressed text) and UTF-16 little-endian text. Word document can also contain 'East Asian' or 'Complex script' languages. Also the text stream contains information about all the parts of the Word document (header/footer, foot/endnote, annotation, etc.)
 Therefore using basic Unix string is very rough approach of finding data in a Word document. Use the wvtools or more sophisticated tools instead.
 [[Category:File Formats]]

@@ Line 52: / Line 52: @@
 (where /tmp/test.doc is the path to your .doc file)
-Note that a Word 97 and later document can contain both extended ASCII with codepage 1252 (codepage 1252 compressed text) and UTF-16 little-endian text. So using basic Unix string is not worth much. Use the sleuthkit strings or EnCase instead.
+Note that a Word 97 and later document can contain both extended ASCII with codepage 1252 (codepage 1252 compressed text) and UTF-16 little-endian text. Word document can also contain 'East Asian' or 'Complex script' languages. Also the text stream contains information about all the parts of the Word document (header/footer, foot/endnote, annotation, etc.)
 [[Category:File Formats]]

@@ Line 52: / Line 52: @@
 (where /tmp/test.doc is the path to your .doc file)
-Note that a Word 97 and later document can contain both extended ASCII with codepage 1252 and UTF-16 little-endian text. So using basic Unix string is not worth much. Use the sleuthkit strings or EnCase instead.
+Note that a Word 97 and later document can contain both extended ASCII with codepage 1252 (codepage 1252 compressed text) and UTF-16 little-endian text. So using basic Unix string is not worth much. Use the sleuthkit strings or EnCase instead.
 [[Category:File Formats]]

← Older revision		Revision as of 20:39, 16 January 2010
Line 51:		Line 51:

	(where /tmp/test.doc is the path to your .doc file)		(where /tmp/test.doc is the path to your .doc file)
		+
		+	Note that a Word 97 and later document can contain both extended ASCII with codepage 1252 and UTF-16 little-endian text. So using basic Unix string is not worth much. Use the sleuthkit strings or EnCase instead.

	[[Category:File Formats]]		[[Category:File Formats]]

@@ Line 33: / Line 33: @@
 * WordDocument stream
 * Table stream (0Table, 1Table)
 == Encryption ==

@@ Line 1: / Line 1: @@
-The '''DOC file format''' ('''document file format''') usually has the '''.doc''' extension. Mostly these documents belong to [[Microsoft]] [[Word]] software files. However, other text editing software can be used to display these files (including [[WordPad]], [[WordPerfect]], [[OpenOffice]] and others).
+The '''Word Document (DOC) file format''' has the '''.doc''' extension. This file type originates from [[Microsoft Word]]. However, other word processing software can be used to display these files as well. These include:
-The DOC file format should not be confused with [[DOCX]].
+The Word DOC file format should not be confused with [[DOCX]].
 == MIME types ==

@@ Line 18: / Line 18: @@
 * zz-application/zz-winassoc-doc
-== File Header ==
+== File signature ==
-[[Microsoft Word]] documents of version 97-2003 use the [[OLE Compound File]] (OLECF).
+[[Microsoft Word]] documents of version 97-2003 use the [[OLE Compound File]] (OLECF). These files therefore have the OLECF file signature
-−
-The Word Binary File format is stored in the OLECF.
 The object stream of the OLECF containing a Word document contains the string "Word.Document" with some version.
 == Encryption ==

@@ Line 20: / Line 20: @@
 == File Header ==
-MS Word documents of version 97 (and probably earlier) begin with the file signature (in hexadecimal) d0cf11e0a1b11ae1 .
+[[Microsoft Word]] documents of version 97-2003 use the [[OLE Compound File]] (OLECF).
-This signature signifies the file to be an OLE Compound File (AKA Compound Document File or Compound Binary File)
-The OLE Compound File has no distinct footer and a can be considered a file containing a FAT like file system.
+The Word Binary File format is stored in the OLECF.
-The Word document format is places on top of the OLE Compound File.
+The object stream of the OLECF containing a Word document contains the string "Word.Document" with some version.
-−
-The object stream of a word documents contains the string "Word.Document" with some version.
 == Encryption ==
@@ Line 33: / Line 30: @@
 Versions 97/2000 encrypt documents with a very weak algorithm. This password scheme can be broken easily by several different products and it is possible to decrypt the contents without discovering the password. This is done by testing all 1,099,511,627,776 possible keys. Ultimate Zip Cracker by VDGSoftware is one utility that can perform this decryption.
 == See Also==
-Be warned this file contains at least one error: the directory entry name length is a size in bytes not in characters.
+[http://download.microsoft.com/download/0/B/E/0BE8BDD7-E5E8-422A-ABFD-4342ED7AD886/Word97-2007BinaryFileFormat(doc)Specification.pdf Word 97-2007 Binary File Format by Microsoft]
 == Extracting Strings ==