Data Hidden In Word Documents

Hi all,

As you may all be aware, MS Word stores a lot of hidden information in saved documents that details a number of things about that document. Such information includes paragraph formatting of the document etc.

However, I've heard that other information is also included in this way, such as the username of the user that created the document, the NetBIOS name of the machine on which the document was created and other stuff.

Does anyone know of any tools out there on the net that would allow me to analyse Word Documents and view this information added by Word to the *.doc file.

I've used the "properties" option in Word to look at some of this information, but I want to make sure I'm viewing everything thats really there, not just what MS want me to see.

Any help researching this would be greatly appreciated.

Thanks in advance.

Alan Mott
[email protected]

:p

I have tried searching google on this information, but it is pretty hard to come up with the right keywords. So far, I think that it had something to do with Meta data. I haven't acturally located any of these tools, but here are the few links I have found so far:

http://www.nwfusion.com/columnists/2...schwartau.html

http://www.microsystems.com/Shares_Well.htm

http://www.cs.uit.no/~tobias/NEW/word-rejection.html

My Googling terms were: Word Document Secret MetaData


If anyone finds out any more information on this, such as a metadata revealing tool, please post here and let me know.

-Tim_axe

You could analyse the documents by opening them in a hexeditor.
That will reveal it.
There is some interesting stuff hidden sometimes, for example the last names the document had. (like 'letter to boss' was 'letter to idiot' !)

I once looked at a tool called MetaDataAssistent, this too can extract loads of MetaData from Excel and word docs.
You can find this tool at payneconsulting , a demo version can be downloaded from their page. (the Demo version can only read files, but cannot make changes)

One thing that is definitely stored in word docs is the mac address of any adapters you have in your computer, as well as distinguishing information about your processor. This is what was used to track down the author of the Melissa virus.

It's pretty much a digital fingerprint that's pretty easy to obtain, especially with any good script. I wouldn't be surprised if microsoft uses it to track people via windows update.....

If you're not running a *good* copy of Office or Windows, seriously turn off automatic updates....