This Article 
   
 Share 
   
 Bibliographic References 
   
 Add to: 
 
Digg
Furl
Spurl
Blink
Simpy
Google
Del.icio.us
Y!MyWeb
 
 Search 
   
New XML-Based Files Implications for Forensics
March/April 2009 (vol. 7 no. 2)
pp. 38-44
Simson L. Garfinkel, US Naval Postgraduate School
James J. Migletz, US Marine Corps
Two new office document file formats (Office Open XML and OpenDocument Format) make it easier to glean time stamps and unique document identifiers while also improving opportunities for file carving and data recovery.

1. S. Rodriguez, "Microsoft Office XML Formats? Defective by Design," Aug. 2007; http://ooxmlisdefectivebydesign.blogspot.com/ 2007/08microsoft-office-xml-formats-defective.html .
2. S. Garfinkel, "Carving Contiguous and Fragmented Files with Fast Object Validation," Digital Investigation, 2007; www.dfrws.org/2007/proceedingsp2-garfinkel.pdf .
3. P. Lagadec, "Openoffice/Opendocument and MS Office 2007/Open XML Security," Proc. Pacific Security Conf., 2006; http://pacsec.jp/psj06psj06lagadec-e.pdf .
4. S. Garfinkel, "Forensic Feature Extraction and Cross-Drive Analysis," Proc. 6th Ann. Digital Forensic Research Workshop, Elsevier, 2006; www.dfrws.org/2006/proceedings10-Garfinkel.pdf .
5. Ecma-376 Standard, Office Open XML File Formats, Dec. 2008; www.ecma-international.org/publications/ standardsEcma-376.htm.
6. P. Aven, "A Final 'Word': Part 6 in a Series on Marklogic Servers and Office 2007," 22 Jan. 2008; http://xqzone.marklogic.com/columnssmallchanges .
7. F. Buchholz and B. Tjaden, "A Brief Study of Time," Proc. 7th Ann. Digital Forensics Research Workshop, Elsevier, 2007; www.dfrws.org/2007proceedingsp31-buchholz.pdf .
8. [Ms-offcrypto]: Office Document Cryptography Structure Specification, Microsoft, 27 June 2008; http://msdn.microsoft.com/en-us/librarycc313071.aspx .

Index Terms:
Office Open XML, OpenDocument Format, ODF, .docx, .pptx, .xlsx, .ods, .odt, .odp, time, information tracking, file carving, digital forensics
Citation:
Simson L. Garfinkel, James J. Migletz, "New XML-Based Files Implications for Forensics," IEEE Security & Privacy, vol. 7, no. 2, pp. 38-44, March-April 2009, doi:10.1109/MSP.2009.44
Usage of this product signifies your acceptance of the Terms of Use.