Viewing hidden data in msword documents?

I found something interesting while crusing on astalavista. This person had found that microsoft keeps deleted information intact with the word document and that it's just not visible in normal viewing. It's pretty interesting. The links is http://lcamtuf.coredump.cx/strikeout/


I was wondering if anyone knows of any tools that will work on windows or how to manually find this information? There are some personal word documents that I've recieved from other people that I would like to look at.

Any help would be great

thanks

google "metadata". Usually you can see some of the metadata by just looking at the description of the document, and its properties. I'm not sure if its still the same way on the newer office suites, but word 97 was horrendous.

strings.exe is your friend. It can view the unicode hidden in the documents.

Just copy it to a .txt file then look at it in Wordpad/Notepad

You will pretty soon learn where to look, as it is consistent in its geography

:)

I have had success with native "strings" on linux. Can be kinda fun. Check out some of the bosses docs, you may find metadata contain within about you!

This product works pretty well. I've used for forensic examinations.

http://www.payneconsulting.com/publi...p?nProductID=7

George Shrout
CCE, Security+

Also, I had read about this during the sniper fiasco on the east coast, here are a couple of other programs that unix users can use:

"Unix and Linux users can turn to tools such as Antiword and Catdoc to turn the document, including its formatting information, into a simple text file."

Source: http://news.bbc.co.uk/2/hi/technology/3154479.stm

Bitform released a free tool that shows all kinds of hidden data. It provides an extensive report and it's available for Windows and Unix and can even run on a Mac.

Check www.bitform.net

Well, I think too that the best solution is to copy the .doc file, rename it in .text file, and open it with notepad.

Here is what you can see :

_PID_GUID   _PID_HLINKS  ä A N
{ D 6 F A 564652 9 5 - 9 5 F 4 - 1 1 D 7 - B B B E - 0 0 3 1231210 4 F 1 0 B C 4 E }
A €   s y      $
t e s t  t e s t
 

[   $ @ñÿ $  N o r m a l   mH,
`
 ,  T i t r e 1 
$
@&  5 2 A@òÿ¡ 2  P o l i c e p a r d é f a u t 4 U`¢ ñ 4  L i e n h y p e r t e x t e  >*
B** >`

*  T i t r e   $
 5CJ Ü    ÿÿÿÿ  Ü   C Ü     
 C ] Ü X”ÿ•€ » à E G H Q ½ Ì  “ À Ç È Ó é ï Þ            
     ÿÿ  t e s t , C : \ M e s D o c u m e n t s
\ _ g u i d e \ A n n e x e s \ a d r e s s e s . d o c ÿ@€
Û Û
 ø”Ä
Û Û # Ü `
 @  G


T i m e s N e w R o m a n 5
 


  € S y m b o l I&


A r i a l H e l v e t i c a "  qˆ Ä
©
²vFvF  Ù Õ
  






¥À´ ´ € 0
ï  ÿÿ
O
 t e s t  t e s t

Hmmmmmmmmm

Well that is "raw"

try this :D

some of you might have heard of the British government's "sexed up" security report re Iraq?

I think it is funny that two different people have posted saying that you have to rename the file to .txt to open it in notepad.. Which you don't. If you want to open a word doc in notepad, just open notepad, and then tell it to open that file.. Notepad doesn't care what the extension is. The extension only tells windows what program to use when opening it and lets notepad now which files are in it's supposed "native format."

You can tell notepad to open "all documents" or just right click and say open with- notepad.