Study on the tracking revision history of MS Word files for forensic investigation

Doowon Jeong, Sangjin Lee

Research output: Contribution to journalArticle

2 Citations (Scopus)

Abstract

Document forensics remains an important field of digital forensics. To date, previously existing methods focused on the last saved version of the document file stored on the PC; however, the drawback of this approach is that this provides no indication as to how the contents have been modified. This paper provides a novel method for document forensics based on tracking the revision history of a Microsoft Word file. The proposed method concentrates on the TMP file created when the author saves the file and the ASD file created periodically by Microsoft Word during editing. A process whereby the revision history lists are generated based on metadata of the Word, TMP, and ASD files is presented. Furthermore, we describe a technique developed to link the revision history lists based on similarity. These outcomes can provide considerable assistance to a forensic investigator trying to establish the extent to which document file contents have been changed and when the file was created, modified, deleted, and copied.

Original languageEnglish
JournalDigital Investigation
DOIs
Publication statusAccepted/In press - 2017 Jan 1

Keywords

  • Document forensic
  • Forensic investigation
  • Microsoft word file
  • Revision history
  • Temporary file

ASJC Scopus subject areas

  • Computer Science Applications
  • Medical Laboratory Technology
  • Law

Fingerprint Dive into the research topics of 'Study on the tracking revision history of MS Word files for forensic investigation'. Together they form a unique fingerprint.

  • Cite this