Overclockers UK Forums Click here for more details
Free Shipping for Loyal Forum Members - CLICK HERE

Go Back   Overclockers UK Forums > Software > Windows & Other Software

Reply
 
Thread Tools
Old 18th Aug 2010, 12:10   #1
Ednagold
Gangster
 
Joined: Oct 2002
Location: Sheffield
Posts: 367
Suspicious word document- how to find out who wrote it?

Just asking for a tiny bit of advice, for which I suspect the answer is no but worth a try.

A word document is doing the rounds at work which nobody is owning up to having written.

Am very intrigued for my own interest to find out who wrote it but they have removed all information in the properties > summary boxes in the document.

A quick search on the internet seems to suggest this would've been the only way of finding out- I take it there is no other way somebody can leave their trace/mark in a word document?
Ednagold is offline   View trust for Reply With Quote
Old 18th Aug 2010, 12:12   #2
Rroff
Caporegime
 
Rroff's Avatar
 
Joined: Oct 2006
Posts: 39,336
Try opening it up in a text editor - sometimes previous revision data, etc. is still stored away in the fileformat.

Samsung 700G7C, i7 3610QM, 16GB DDR3, GTX 675M.
i7 4820K, GB X79-UD3, KHX Beast 16GB DDR3, Gigabyte GTX780 GHZ, Antec Kúhler 1250, 840 EVO 250GB, KHX 3K 240GB, Seasonic 860w Platinum.
Rroff is online now   View trust for Reply With Quote
Old 18th Aug 2010, 12:31   #3
Ednagold
Gangster
 
Joined: Oct 2002
Location: Sheffield
Posts: 367
Quote:
Originally Posted by Rroff View Post
Try opening it up in a text editor - sometimes previous revision data, etc. is still stored away in the fileformat.

Thanks- I've downloaded textpad if thats what you meant. If you recommend a different one that'd be helpful
Ednagold is offline   View trust for Reply With Quote
Old 18th Aug 2010, 12:36   #4
matthab
Mobster
 
matthab's Avatar
 
Joined: Apr 2009
Posts: 2,743
right click open in notepad he means.

Sometimes if you right clikc on the document and click propertise > summary > advanced. It sometimes stores the details in there.

matthab is offline   View trust for Reply With Quote
Old 18th Aug 2010, 12:45   #5
Ednagold
Gangster
 
Joined: Oct 2002
Location: Sheffield
Posts: 367
Yeah unfortunately is has nothing in the advanced bit either. It just says "author" but nothing next to it.

Opening in notepad turns all the font into bizarre characters!
Ednagold is offline   View trust for Reply With Quote
Old 18th Aug 2010, 12:59   #6
Ednagold
Gangster
 
Joined: Oct 2002
Location: Sheffield
Posts: 367
Would be glad to forward it to anyone to have a play with!
Ednagold is offline   View trust for Reply With Quote
Old 18th Aug 2010, 13:00   #7
Rroff
Caporegime
 
Rroff's Avatar
 
Joined: Oct 2006
Posts: 39,336
forward it to the email in my trust if ya like and I'll have a look

Samsung 700G7C, i7 3610QM, 16GB DDR3, GTX 675M.
i7 4820K, GB X79-UD3, KHX Beast 16GB DDR3, Gigabyte GTX780 GHZ, Antec Kúhler 1250, 840 EVO 250GB, KHX 3K 240GB, Seasonic 860w Platinum.
Rroff is online now   View trust for Reply With Quote
Old 18th Aug 2010, 13:25   #8
Rroff
Caporegime
 
Rroff's Avatar
 
Joined: Oct 2006
Posts: 39,336
Unfortunatly doesn't appear to be any useful data, the xml files have all been purged of any modified data, the images don't appear to have any useful EXIF tags, etc.

Samsung 700G7C, i7 3610QM, 16GB DDR3, GTX 675M.
i7 4820K, GB X79-UD3, KHX Beast 16GB DDR3, Gigabyte GTX780 GHZ, Antec Kúhler 1250, 840 EVO 250GB, KHX 3K 240GB, Seasonic 860w Platinum.
Rroff is online now   View trust for Reply With Quote
Old 18th Aug 2010, 13:52   #9
Pho
Sgarrista
 
Pho's Avatar
 
Joined: Oct 2002
Location: Derbyshire
Posts: 8,404
I'll have a look if you like as well (sig), though it doesn't look promising ^ .

Pho is online now   View trust for Reply With Quote
Old 20th Aug 2010, 13:31   #10
Ednagold
Gangster
 
Joined: Oct 2002
Location: Sheffield
Posts: 367
Quote:
Originally Posted by Pho View Post
I'll have a look if you like as well (sig), though it doesn't look promising ^ .
Thanks will email you now
Ednagold is offline   View trust for Reply With Quote
Old 20th Aug 2010, 14:48   #11
Pho
Sgarrista
 
Pho's Avatar
 
Joined: Oct 2002
Location: Derbyshire
Posts: 8,404
Pretty much the same as Rroff has found for me.

Unless the document has been re-saved by someone I did find this in the XML:
PHP Code:
<cp:lastModifiedBy> </cp:lastModifiedBy>
<
cp:revision>2</cp:revision>
<
cp:lastPrinted>2010-08-12T07:43:00Z</cp:lastPrinted>
<
dcterms:created xsi:type="dcterms:W3CDTF">2010-08-16T07:23:00Z</dcterms:created>
<
dcterms:modified xsi:type="dcterms:W3CDTF">2010-08-16T07:23:00Z</dcterms:modified
If it was printed at work, could you not get the IT staff to check the printer logs, or the logon times of users to see who was activate at that time? 07:23:00 is fairly early so you wouldn't have thought many people would be around then. Or even a mass search based on the filename it was sent under.


Also, how did you receive the file originally, though email? If so the email headers might be useful, again if you want to forward those I can take a look. If you use outlook this explains how to view the headers: http://email.about.com/od/outlooktip...in_Outlook.htm

Pho is online now   View trust for Reply With Quote
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump


All times are GMT. The time now is 23:46.


Powered by vBulletin®
Copyright ©2000 - 2016, Jelsoft Enterprises Ltd.
© Overclockers UK (Ocuk Ltd)