Viewing hidden data in msword documents?
Page 1 of 2 12 LastLast
Results 1 to 10 of 11

Thread: Viewing hidden data in msword documents?

  1. #1
    Senior Member
    Join Date
    Jun 2002
    Posts
    102

    Viewing hidden data in msword documents?

    I found something interesting while crusing on astalavista. This person had found that microsoft keeps deleted information intact with the word document and that it's just not visible in normal viewing. It's pretty interesting. The links is http://lcamtuf.coredump.cx/strikeout/


    I was wondering if anyone knows of any tools that will work on windows or how to manually find this information? There are some personal word documents that I've recieved from other people that I would like to look at.

    Any help would be great

    thanks
    Good Grief

  2. #2
    HeadShot Master N1nja Cybr1d's Avatar
    Join Date
    Jul 2003
    Location
    Boston, MA
    Posts
    1,840
    google "metadata". Usually you can see some of the metadata by just looking at the description of the document, and its properties. I'm not sure if its still the same way on the newer office suites, but word 97 was horrendous.

  3. #3
    Computer Forensics
    Join Date
    Jul 2001
    Posts
    672
    strings.exe is your friend. It can view the unicode hidden in the documents.
    Antionline in a nutshell
    \"You\'re putting the fate of the world in the hands of a bunch of idiots I wouldn\'t trust with a potato gun\"

    Trust your Technolust

  4. #4
    Senior Member nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,190
    Just copy it to a .txt file then look at it in Wordpad/Notepad

    You will pretty soon learn where to look, as it is consistent in its geography


  5. #5
    Junior Member
    Join Date
    Oct 2004
    Posts
    4
    I have had success with native "strings" on linux. Can be kinda fun. Check out some of the bosses docs, you may find metadata contain within about you!

  6. #6
    Junior Member
    Join Date
    Nov 2004
    Posts
    5

    Metadata tool

    This product works pretty well. I've used for forensic examinations.

    http://www.payneconsulting.com/publi...p?nProductID=7

    George Shrout
    CCE, Security+

  7. #7
    Junior Member
    Join Date
    Jun 2003
    Posts
    4
    Also, I had read about this during the sniper fiasco on the east coast, here are a couple of other programs that unix users can use:

    "Unix and Linux users can turn to tools such as Antiword and Catdoc to turn the document, including its formatting information, into a simple text file."

    Source: http://news.bbc.co.uk/2/hi/technology/3154479.stm

  8. #8
    Junior Member
    Join Date
    Feb 2005
    Posts
    5
    Bitform released a free tool that shows all kinds of hidden data. It provides an extensive report and it's available for Windows and Unix and can even run on a Mac.

    Check www.bitform.net

  9. #9
    Well, I think too that the best solution is to copy the .doc file, rename it in .text file, and open it with notepad.

    Here is what you can see :

    _PID_GUID  _PID_HLINKS   A N
    { D 6 F A 564652 9 5 - 9 5 F 4 - 1 1 D 7 - B B B E - 0 0 3 1231210 4 F 1 0 B C 4 E }
    A   s y      $
    t e s t  t e s t
     
     [   $ @ $  N o r m a l   mH , `  ,  T i t r e 1   $@&  5 2 A@ 2  P o l i c e p a r d f a u t 4 U` 4  L i e n h y p e r t e x t e  >*B** >` *  T i t r e   $  5CJ        C     
     C ]  X E G H Q                       
           t e s t , C : \ M e s D o c u m e n t s
    \ _ g u i d e \ A n n e x e s \ a d r e s s e s . d o c @ 
        #  `  @  G 
      T i m e s N e w R o m a n 5 
      S y m b o l I&  
     A r i a l H e l v e t i c a "  q 
     vFvF      
      


     0
        O
     t e s t  t e s t
    Alain STEVENS, cyberdetective
    Computer Forensics and Internet Investigations
    http://www.alainstevens.com

  10. #10
    Senior Member nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,190
    Hmmmmmmmmm

    Well that is "raw"

    try this

    some of you might have heard of the British government's "sexed up" security report re Iraq?

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •