The Community for Technology Leaders
RSS Icon
Subscribe
Issue No.02 - March/April (2009 vol.7)
pp: 38-44
Simson L. Garfinkel , US Naval Postgraduate School
James J. Migletz , US Marine Corps
ABSTRACT
Two new office document file formats (Office Open XML and OpenDocument Format) make it easier to glean time stamps and unique document identifiers while also improving opportunities for file carving and data recovery.
INDEX TERMS
Office Open XML, OpenDocument Format, ODF, .docx, .pptx, .xlsx, .ods, .odt, .odp, time, information tracking, file carving, digital forensics
CITATION
Simson L. Garfinkel, James J. Migletz, "New XML-Based Files Implications for Forensics", IEEE Security & Privacy, vol.7, no. 2, pp. 38-44, March/April 2009, doi:10.1109/MSP.2009.44
REFERENCES
1. S. Rodriguez, "Microsoft Office XML Formats? Defective by Design," Aug. 2007; http://ooxmlisdefectivebydesign.blogspot.com/ 2007/08microsoft-office-xml-formats-defective.html .
2. S. Garfinkel, "Carving Contiguous and Fragmented Files with Fast Object Validation," Digital Investigation, 2007; www.dfrws.org/2007/proceedingsp2-garfinkel.pdf .
3. P. Lagadec, "Openoffice/Opendocument and MS Office 2007/Open XML Security," Proc. Pacific Security Conf., 2006; http://pacsec.jp/psj06psj06lagadec-e.pdf .
4. S. Garfinkel, "Forensic Feature Extraction and Cross-Drive Analysis," Proc. 6th Ann. Digital Forensic Research Workshop, Elsevier, 2006; www.dfrws.org/2006/proceedings10-Garfinkel.pdf .
5. Ecma-376 Standard, Office Open XML File Formats, Dec. 2008; www.ecma-international.org/publications/ standardsEcma-376.htm.
6. P. Aven, "A Final 'Word': Part 6 in a Series on Marklogic Servers and Office 2007," 22 Jan. 2008; http://xqzone.marklogic.com/columnssmallchanges .
7. F. Buchholz and B. Tjaden, "A Brief Study of Time," Proc. 7th Ann. Digital Forensics Research Workshop, Elsevier, 2007; www.dfrws.org/2007proceedingsp31-buchholz.pdf .
8. [Ms-offcrypto]: Office Document Cryptography Structure Specification, Microsoft, 27 June 2008; http://msdn.microsoft.com/en-us/librarycc313071.aspx .
15 ms
(Ver 2.0)

Marketing Automation Platform Marketing Automation Tool