Suspicious word document- how to find out who wrote it?

Associate
Joined
18 Oct 2002
Posts
367
Location
Sheffield
Just asking for a tiny bit of advice, for which I suspect the answer is no but worth a try.

A word document is doing the rounds at work which nobody is owning up to having written.

Am very intrigued for my own interest to find out who wrote it but they have removed all information in the properties > summary boxes in the document.

A quick search on the internet seems to suggest this would've been the only way of finding out- I take it there is no other way somebody can leave their trace/mark in a word document?
 
Man of Honour
Joined
13 Oct 2006
Posts
90,819
Try opening it up in a text editor - sometimes previous revision data, etc. is still stored away in the fileformat.
 
Soldato
Joined
19 Apr 2009
Posts
3,159
right click open in notepad he means.

Sometimes if you right clikc on the document and click propertise > summary > advanced. It sometimes stores the details in there.
 
Associate
OP
Joined
18 Oct 2002
Posts
367
Location
Sheffield
Yeah unfortunately is has nothing in the advanced bit either. It just says "author" but nothing next to it.

Opening in notepad turns all the font into bizarre characters!
 
Man of Honour
Joined
13 Oct 2006
Posts
90,819
Unfortunatly doesn't appear to be any useful data, the xml files have all been purged of any modified data, the images don't appear to have any useful EXIF tags, etc.
 

Pho

Pho

Soldato
Joined
18 Oct 2002
Posts
9,324
Location
Derbyshire
Pretty much the same as Rroff has found for me.

Unless the document has been re-saved by someone I did find this in the XML:
PHP:
<cp:lastModifiedBy> </cp:lastModifiedBy>
<cp:revision>2</cp:revision>
<cp:lastPrinted>2010-08-12T07:43:00Z</cp:lastPrinted>
<dcterms:created xsi:type="dcterms:W3CDTF">2010-08-16T07:23:00Z</dcterms:created>
<dcterms:modified xsi:type="dcterms:W3CDTF">2010-08-16T07:23:00Z</dcterms:modified>

If it was printed at work, could you not get the IT staff to check the printer logs, or the logon times of users to see who was activate at that time? 07:23:00 is fairly early so you wouldn't have thought many people would be around then. Or even a mass search based on the filename it was sent under.


Also, how did you receive the file originally, though email? If so the email headers might be useful, again if you want to forward those I can take a look. If you use outlook this explains how to view the headers: http://email.about.com/od/outlooktips/qt/How_to_View_All_Message_Headers_in_Outlook.htm
 
Back
Top Bottom