Forensic investigation of Microsoft PowerPoint files

Jungheum Park, Sangjin Lee

Research output: Contribution to journalArticle

10 Citations (Scopus)

Abstract

Nowadays, many electronic documents reside in individual systems and on public networks. Electronic documents contain important information such as private data and trade secrets. Because of this, electronic documents can be used as digital evidence in forensic investigations. Until now, forensic examiners have looked at the contents of an electronic document using specific applications, a procedure which fails to provide them with information about how an electronic document was created. Research into the process by which an electronic document is written can help forensic examiners discover the relationships among several electronic documents and the traces of past work in some special cases. This paper demonstrates new methods for investigating Microsoft PowerPoint files that include some useful information about their own writing process.

Original languageEnglish
Pages (from-to)16-24
Number of pages9
JournalDigital Investigation
Volume6
Issue number1-2
DOIs
Publication statusPublished - 2009 Sep 1

Fingerprint

electronics
examiner
Research
evidence

Keywords

  • Digital forensics
  • Microsoft PowerPoint file
  • Object identifier
  • Residual information
  • Slide identifier

ASJC Scopus subject areas

  • Law
  • Computer Science Applications
  • Medical Laboratory Technology

Cite this

Forensic investigation of Microsoft PowerPoint files. / Park, Jungheum; Lee, Sangjin.

In: Digital Investigation, Vol. 6, No. 1-2, 01.09.2009, p. 16-24.

Research output: Contribution to journalArticle

Park, Jungheum ; Lee, Sangjin. / Forensic investigation of Microsoft PowerPoint files. In: Digital Investigation. 2009 ; Vol. 6, No. 1-2. pp. 16-24.
@article{9e4ceabd75be4e54a118eafcdeace53c,
title = "Forensic investigation of Microsoft PowerPoint files",
abstract = "Nowadays, many electronic documents reside in individual systems and on public networks. Electronic documents contain important information such as private data and trade secrets. Because of this, electronic documents can be used as digital evidence in forensic investigations. Until now, forensic examiners have looked at the contents of an electronic document using specific applications, a procedure which fails to provide them with information about how an electronic document was created. Research into the process by which an electronic document is written can help forensic examiners discover the relationships among several electronic documents and the traces of past work in some special cases. This paper demonstrates new methods for investigating Microsoft PowerPoint files that include some useful information about their own writing process.",
keywords = "Digital forensics, Microsoft PowerPoint file, Object identifier, Residual information, Slide identifier",
author = "Jungheum Park and Sangjin Lee",
year = "2009",
month = "9",
day = "1",
doi = "10.1016/j.diin.2009.05.001",
language = "English",
volume = "6",
pages = "16--24",
journal = "Digital Investigation",
issn = "1742-2876",
publisher = "Elsevier Limited",
number = "1-2",

}

TY - JOUR

T1 - Forensic investigation of Microsoft PowerPoint files

AU - Park, Jungheum

AU - Lee, Sangjin

PY - 2009/9/1

Y1 - 2009/9/1

N2 - Nowadays, many electronic documents reside in individual systems and on public networks. Electronic documents contain important information such as private data and trade secrets. Because of this, electronic documents can be used as digital evidence in forensic investigations. Until now, forensic examiners have looked at the contents of an electronic document using specific applications, a procedure which fails to provide them with information about how an electronic document was created. Research into the process by which an electronic document is written can help forensic examiners discover the relationships among several electronic documents and the traces of past work in some special cases. This paper demonstrates new methods for investigating Microsoft PowerPoint files that include some useful information about their own writing process.

AB - Nowadays, many electronic documents reside in individual systems and on public networks. Electronic documents contain important information such as private data and trade secrets. Because of this, electronic documents can be used as digital evidence in forensic investigations. Until now, forensic examiners have looked at the contents of an electronic document using specific applications, a procedure which fails to provide them with information about how an electronic document was created. Research into the process by which an electronic document is written can help forensic examiners discover the relationships among several electronic documents and the traces of past work in some special cases. This paper demonstrates new methods for investigating Microsoft PowerPoint files that include some useful information about their own writing process.

KW - Digital forensics

KW - Microsoft PowerPoint file

KW - Object identifier

KW - Residual information

KW - Slide identifier

UR - http://www.scopus.com/inward/record.url?scp=70149084965&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=70149084965&partnerID=8YFLogxK

U2 - 10.1016/j.diin.2009.05.001

DO - 10.1016/j.diin.2009.05.001

M3 - Article

AN - SCOPUS:70149084965

VL - 6

SP - 16

EP - 24

JO - Digital Investigation

JF - Digital Investigation

SN - 1742-2876

IS - 1-2

ER -