This Article 
 Bibliographic References 
 Add to: 
New XML-Based Files Implications for Forensics
March/April 2009 (vol. 7 no. 2)
pp. 38-44
Simson L. Garfinkel, US Naval Postgraduate School
James J. Migletz, US Marine Corps
Two new office document file formats (Office Open XML and OpenDocument Format) make it easier to glean time stamps and unique document identifiers while also improving opportunities for file carving and data recovery.

1. S. Rodriguez, "Microsoft Office XML Formats? Defective by Design," Aug. 2007; 2007/08microsoft-office-xml-formats-defective.html .
2. S. Garfinkel, "Carving Contiguous and Fragmented Files with Fast Object Validation," Digital Investigation, 2007; .
3. P. Lagadec, "Openoffice/Opendocument and MS Office 2007/Open XML Security," Proc. Pacific Security Conf., 2006; .
4. S. Garfinkel, "Forensic Feature Extraction and Cross-Drive Analysis," Proc. 6th Ann. Digital Forensic Research Workshop, Elsevier, 2006; .
5. Ecma-376 Standard, Office Open XML File Formats, Dec. 2008; standardsEcma-376.htm.
6. P. Aven, "A Final 'Word': Part 6 in a Series on Marklogic Servers and Office 2007," 22 Jan. 2008; .
7. F. Buchholz and B. Tjaden, "A Brief Study of Time," Proc. 7th Ann. Digital Forensics Research Workshop, Elsevier, 2007; .
8. [Ms-offcrypto]: Office Document Cryptography Structure Specification, Microsoft, 27 June 2008; .

Index Terms:
Office Open XML, OpenDocument Format, ODF, .docx, .pptx, .xlsx, .ods, .odt, .odp, time, information tracking, file carving, digital forensics
Simson L. Garfinkel, James J. Migletz, "New XML-Based Files Implications for Forensics," IEEE Security & Privacy, vol. 7, no. 2, pp. 38-44, March-April 2009, doi:10.1109/MSP.2009.44
Usage of this product signifies your acceptance of the Terms of Use.