Lion Cipher Lab
Date and attribute an Office document from its OOXML metadata
- Digital Forensics & IR (DFIR)
- Intermediate
- ~60 min
- Free · no account required
Why it matters
When a contract, a resignation letter or a leaked memo becomes evidence, someone will ask: who wrote this, and when? The quick answer comes from the document's Properties box, which reads one small XML file inside the document. That file is plain text that anyone can edit, so the quick answer is exactly what a forger targets. A Word document carries several other records that are much less obvious: the list of editing sessions it has been through, the minutes it has been open for editing, the company name of the machine that saved it, and the clock time on every file inside the ZIP. Each one…
What you'll learn
- Opening a .docx or .xlsx as the ZIP package it really is and naming the parts that carry metadata
- Reading docProps/core.xml (creator, lastModifiedBy, revision, created, modified) and docProps/app.xml (TotalTime, Company, Template)
- Using revision save IDs (w:rsidRoot and w:rsid in word/settings.xml) to establish common origin and save order between documents
- Interpreting ZIP entry timestamps: MS-DOS format, no time zone, 2-second precision
- Building a consistency checker that turns several weak signals into findings, and measuring what core.xml alone gets wrong
- Stating plainly what OOXML metadata cannot prove, because every field can be rewritten
Steps in this lab
- The case, and why the Properties box is not the answer
- A .docx is a ZIP of XML parts - the four places metadata hides
- Revision save IDs: what the standard says you may infer
- ZIP timestamps: MS-DOS format, no time zone, 2-second steps
- Build the five case documents
- Read every file, then ask core.xml alone
- Cross-check every witness and read the findings
- The careful forger beats every check - measure it
- Try the same reading on a document of your own
- When to rely on this, and how a pro does it better