Viewing hidden data in msword documents?

[July]

I found something interesting while crusing on astalavista. This person had found that microsoft keeps deleted information intact with the word document and that it's just not visible in normal viewing. It's pretty interesting. The links is http://lcamtuf.coredump.cx/strikeout/


I was wondering if anyone knows of any tools that will work on windows or how to manually find this information? There are some personal word documents that I've recieved from other people that I would like to look at.

Any help would be great

thanks

[Cybr1d]

google "metadata". Usually you can see some of the metadata by just looking at the description of the document, and its properties. I'm not sure if its still the same way on the newer office suites, but word 97 was horrendous.

[hogfly]

strings.exe is your friend. It can view the unicode hidden in the documents.

[nihil]

Just copy it to a .txt file then look at it in Wordpad/Notepad

You will pretty soon learn where to look, as it is consistent in its geography

[dajackman]

I have had success with native "strings" on linux. Can be kinda fun. Check out some of the bosses docs, you may find metadata contain within about you!

[shroutosaur]

This product works pretty well. I've used for forensic examinations.

http://www.payneconsulting.com/publi...p?nProductID=7

George Shrout
CCE, Security+

[throck morton]

Also, I had read about this during the sniper fiasco on the east coast, here are a couple of other programs that unix users can use:

"Unix and Linux users can turn to tools such as Antiword and Catdoc to turn the document, including its formatting information, into a simple text file."

Source: http://news.bbc.co.uk/2/hi/technology/3154479.stm

[drsecure]

Bitform released a free tool that shows all kinds of hidden data. It provides an extensive report and it's available for Windows and Unix and can even run on a Mac.

Check www.bitform.net

[cyberdetective]

Well, I think too that the best solution is to copy the .doc file, rename it in .text file, and open it with notepad.

Here is what you can see :

_PID_GUID   _PID_HLINKS  ä A N
{ D 6 F A 564652 9 5 - 9 5 F 4 - 1 1 D 7 - B B B E - 0 0 3 1231210 4 F 1 0 B C 4 E }
A €   s y      $
t e s t  t e s t
 

[   $ @ñÿ $  N o r m a l   mH,
`
 ,  T i t r e 1 
$
@&  5 2 A@òÿ¡ 2  P o l i c e p a r d é f a u t 4 U`¢ ñ 4  L i e n h y p e r t e x t e  >*
B** >`

*  T i t r e   $
 5CJ Ü    ÿÿÿÿ  Ü   C Ü     
 C ] Ü X”ÿ•€ » à E G H Q ½ Ì  “ À Ç È Ó é ï Þ            
     ÿÿ  t e s t , C : \ M e s D o c u m e n t s
\ _ g u i d e \ A n n e x e s \ a d r e s s e s . d o c ÿ@€
Û Û
 ø”Ä
Û Û # Ü `
 @  G


T i m e s N e w R o m a n 5
 


  € S y m b o l I&


A r i a l H e l v e t i c a "  qˆ Ä
©
²vFvF  Ù Õ
  






¥À´ ´ € 0
ï  ÿÿ
O
 t e s t  t e s t

[nihil]

Hmmmmmmmmm

Well that is "raw"

try this

some of you might have heard of the British government's "sexed up" security report re Iraq?