Microsoft Office 2007-2010 Registry Artifacts FINAL

1 AccessData Dustin Hurlbut Page 1 Microsoft Office 2007 , 2010 Registry Artifacts Dustin Hurlbut September 16, 2010 INTRODUCTION Previous versions of Microsoft Office used application specific Registry Artifacts to track opened documents. Largely, they were not consistent and some were not functioning by default. Their forensic importance was limited in some versions to showing documents that had been saved or saved using the Save As dialog box. With the release of Office 2007 , the application specific Artifacts were changed and would appear to have greater forensic significance. Besides storing a larger number of Most Recently Used (MRUs) information that denotes a document was opened, some of the Office applications now contain a date and time stamp that refers either to when the document was last opened or when that document was last saved by the user.

2 This paper will cover the new application specific Artifacts as well as default Artifacts from the operating system. It will show how they are created and what criteria seem to affect their modification. MRU INFORMATION Previous versions of Microsoft Office used some application specific MRUs information which was stored in the Registry . The information is stored on a per-user basis and so resides in the Registry file located at: C:\Documents and Settings\<username> Windows 2000 and Windows XP C:\Users\<username> Windows Vista and Windows 7 The information was stored in the following path in the Registry : HKCU\Software\ Microsoft \ Office \<version#>\<appname> The version number for various Office installations are: Office 97 Version Office 2000 Version Office XP 2002 Version Office 2003 Version Office 2007 Version Office 2010 Version According to a reference in Wikipedia, Microsoft skipped the 13th version number1.

3 Figure 1 shows a system with Office 2000, Office 2007 , and Office 2010 installed with the 2007 version Registry keys AccessData Dustin Hurlbut Page 2 opened. Multiple versions can exist on the same system. Each has its own separate archive in the Registry and they do not seem to intermix. Figure 1 Office 2007 Version Information The <appname> variable would be the application name of Excel, PowerPoint, Word, etc. Earlier versions used MRUs for both Open and Save As, however the archiving of MRU data was inconsistent. Figure 2 shows the Office 2010 version information and Registry subkeys. Some Office versions will contain more references to application than others as the subkeys for each are only created on installation of that particular Microsoft product. Also, different applications will have different MRU lists.

4 For example; Access uses the Settings subkey and calls them MRU# (where # is a variable indicating a number), and Excel stores them in a File MRU subkey and calls them Item#. Figure 2 Office 2010 Version Information Microsoft made some major changes to Office 2007 MRU lists from previous versions. The Open and Save As MRUs were replaced with a single MRU called File MRU. Instead of the last twelve or fifteen documents, the number now tracks the last 50 documents opened by the user for Excel, PowerPoint, AccessData Dustin Hurlbut Page 3 and Word (see Figure 3). The File MRU entries are numbered from Item1 to Item50 (decimal numbers). Item 1 is the last viewed and the Item 50 is the furthermost viewed (see Figure 3). Figure 3 Office 2007 Word MRU List There are active MRU lists for Microsoft s installed Office documents.

5 The examples here include the most common: Access ( Microsoft s Database application), Excel, PowerPoint, Publisher, and Word. Microsoft Access Stores the nine last opened document MRUs under the Settings subkey. They are named MRU1 MRU9. They contain not only the filename, but the complete path to the file. The Access Database application must be closed before the key is updated. Interestingly, the MRU list also has an accompanying MRU set below them called MRUDate1 MRUDate9. These values match up to the numbers of the MRU set for the files and show the date the particular document was last opened in month / day / year format. So the path and filename match up to the MRUDate1 to show the date that document was last opened (see Figure 4). AccessData Dustin Hurlbut Page 4 Figure 4 Microsoft Access DB MRU List Microsoft Excel Stores the MRUs under the File MRU subkey (see Figure 5).

6 They are named Item1 Item50 and hold up to 50 of the last spreadsheets opened. They contain not only the filename, but the complete path to the file. The Excel application updates the MRU list as soon as the document is opened. Figure 5 Microsoft Excel MRU List Microsoft PowerPoint Stores the MRUs under the File MRU subkey (see Figure 6). They are named Item1 Item50 and hold up to 50 of the last slide shows opened. They contain not only the filename, but the complete path to the file. The PowerPoint application updates the MRU list as soon as the document is opened. Associated MRU Dates Access MRUs AccessData Dustin Hurlbut Page 5 Figure 6 Microsoft PowerPoint MRU List Microsoft Publisher Stores the MRUs under the Recent File List subkey (see Figure 7). They are named File1 File9 and hold nine of the last Publisher documents opened.

7 They contain not only the filename, but the complete path to the file. The Publisher application updates the MRU list as soon as the document is opened. Figure 7 Microsoft Publisher MRU List Microsoft Word Stores the MRUs under the File MRU subkey (see Figure 8). They are named Item1 Item50 and hold up to 50 of the last documents opened. They contain the filename and the complete path to the file. The Word application updates the MRU list as soon as the document is opened. Figure 8 Microsoft Word MRU List AccessData Dustin Hurlbut Page 6 The Windows operating system also creates the MRU values by extension type in the RecentDocs and Comdlg32 Registry keysets. The RecentDocs keyset stores the last ten documents opened for each extension type in individual values. They are numbered from 0 to 9 with an additional MRUListEx value that tracks the order they were opened.

8 The value number at the beginning of the MRUListEx is the latest viewed document and the following numbers are in descending order. As seen in Figure 9, the last .docx file viewed is the hex value 0x 07 00 00 00. The number 07 equates to the document file value displayed in the lower pane. The previous document before that was 03, and the one before that was 09. The values can get mixed up as the RecentDocs\<ext> does not store duplicates. A file opened previously that has already been assigned a number is reused if the document is reopened. Opening another document when the MRU list has the full ten values, will drop off the oldest in favor of the most recent document. Figure 9 RecentDocs MRU (Vista OS) AccessData Dustin Hurlbut Page 7 ComDlg32, or Common Dialog, is also used to track documents that have been opened or edited using the standard Microsoft Save As dialog box.

9 It is similar to the RecentDocs MRU and stores the most recent documents by extension. It holds more values, in the case of Vista and Windows 7, storing the last 20. In Windows XP, the path and filename were displayed. However, in Vista and Windows 7, only the filename is archived. Figure 10 displays an example of the MRU values. Note there is an MRUListEx to track the order of access of the documents using decimal numbering in the value name, but using hexadecimal numbers in the MRUListEx value. In the example in Figure 10, the last document processed through the Save As dialog box was a draft of this document as it was being written. It does correspond as the last one in both RecentDocs and ComDlg32. Figure 10 ComDlg32 Common Dialog MRU (Vista OS) Note: Documents shouldn t generally be compared between RecentDocs and the ComDlg32 keysets.

10 Some applications use their own Save As dialog boxes and some use the standard AccessData Microsoft Save As dialog box. Those that are using their own proprietary box will not appear in ComDlg32 keys as this keyset is only Save As dialog box. DATE AND TIME INDICATIONS In Office 2007 , Microsoft added a new feature to now a header that precedes the path The header is defined by a bracketed [F00000000]. Following this is a second bracketed dataset starting with a T . The numbers following the T last opened by the user. This is true for both Word and Excel. Hlast time the document was opened by the user or the last time the document was saved by the save in PowerPoint trips this value again. Note: This sequence is dependedocuments are opened, this behavior may change. same time in the same application, saving the latest save on top with the number 1.