This wiki will be going offline permanently in the near future. An exact date will be announced soon. Thank you for being a part of this community.
If you wish to work on the new forensicswiki, please join the Google Group forensicswiki-reborn
Word Document (DOC)
The DOC file format (document file format) usually has the .doc extension. Mostly these documents belong to Microsoft Word software files. However, other text editing software can be used to display these files (including WordPad, WordPerfect, OpenOffice and others).
The DOC file format should not be confused with DOCX.
The Word Binary File format is stored in the OLECF.
The object stream of the OLECF containing a Word document contains the string "Word.Document" with some version.
Versions 97/2000 encrypt documents with a very weak algorithm. This password scheme can be broken easily by several different products and it is possible to decrypt the contents without discovering the password. This is done by testing all 1,099,511,627,776 possible keys. Ultimate Zip Cracker by VDGSoftware is one utility that can perform this decryption.
On a unix-like machine try this command to extract strings from a .doc file:
cat /tmp/test.doc | tr -d \\0 | strings | more
(where /tmp/test.doc is the path to your .doc file)