Microsoft Office is a set of office/productivity related applications widely used around the world. Microsoft Office includes a variety of applications such as Microsoft Word, Excel, Access and Microsoft PowerPoint. Each application is designed to offer a specific task or service to its users. For example, word processing, managing emails, and creating presentations. Microsoft Office applications are available on desktop, mobile, and via web browsers.
Microsoft Office documents are everywhere. They are one of the most common electronic documents used around the world. Given its popularity and broad usage, Microsoft Office suite software is considered an important source of evidentiary information during the digital forensic analysis process. Microsoft Office artifacts retain information such as the user ID, the files and directories recently accessed by the user and other valuable information that can be vital when conducting digital forensic investigations.
Microsoft Office artifacts are stored in NTUSER.DAT registry hive. If the user is not signed into a Live account, the files and directories recently accessed by Access, Excel, Word, PowerPoint, and Publisher are found in the following subkeys:
This section will discuss how to use ArtiFast to analyze Microsoft Office artifacts from Windows
machines and what kind of digital forensics insights we can gain from the artifacts.
After you have created your case and added evidence for investigation, at the Artifacts Selection phase, you can select Microsoft Office artifacts:
ArtiFast can analyze Microsoft Office Recent Files, Recent Places and Microsoft Office Word Reading Locations. For demonstration purposes, all the artifacts have been chosen, however, you have the option to select one or more artifacts.
Once ArtiFast parser plugins complete processing artifacts for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Microsoft Office artifacts in ArtiFast.
Microsoft Office Recent Files Artifact
This artifact contains information related to the recently accessed files. The details you can view include:
Microsoft Office Recent Places Artifact
This artifact contains information related to the recent directories of the files. The details you can view include:
Microsoft Office Word Reading Locations Artifact
Microsoft Word allows users to continue reading or editing a document starting at the last point they were working on by tracking the positioning of the cursor in the document. This artifact contains information related to this feature. The details you can view include:
For more information or suggestions please contact: [email protected]