How to Access Microsoft Word Last 10 Authors

Computer forensic examinations and litigation support projects often rely on Microsoft Office file metadata. Metadata is information stored in a file that identifies key attributes of the file and can assist a computer forensic examiner and lawyers by establishing key findings in a case. It can assist with the timeline of events for a suspect.

One of the most valuable areas of information is referred to as 'Last 10 Authors'. Last 10 Authors/Locations is an area of a Microsoft Word file that, as it states, stores the last 10 authors and locations for the file.

Many don't realize that last 10 authors isn't normally displayed or made available when metadata is extracted or viewed through computer forensic software, electronic discovery extraction or metadata viewer utilities. The reason that last 10 authors remains hidden is that it doesn't fall into the OLE stream metadata category.

OLE stream metadata is what is visibile and often extracted through computer forensics, electronic discovery and several free utilities. Microsoft provides a dll library to allow software developers to easily access dozens of metadata fields (i.e. Title, Author, Date Last Printed, Date Last Saved etc.), however, the dll and other metadata libraries (as well as scrubbing utilities) don't provide access to the last 10 authors information.

Many attorneys are concerned when they realize the information that is contained in their clients files in the last 10 author area. They become even more concerned when they realize their scrubbing software didn't eliminate the information in this area.

You may be asking yourself, what's the big deal? How does this affect me? In a recent computer forensic exam we were provided a laptop of the suspect and told that it was the computer they used outside of the office. It was claimed that no other computer was used for work related files.

Because of the age of the laptop, size of the hard drive and user log files we doubted that the suspect had used the laptop for much of anything for awhile. Additionally, there were two older operating systems intalled which haven't been used for many years.

We were able to confirm our suspicions on this case using the last 10 author data from several Microsoft Word files on the USB drive that the suspect used to store their working files. We were also able to identify two other computers that the suspect was using to create and edit files which were never examined or produced in the case.

It is important to also understand that the last 10 authors data is not only captured when a user clicks 'save' but Microsoft Word's autosave feature will intermintently save files and store the information in last 10 authors.

To seasoned computer forensic examiners and attorneys the last 10 authors information is used to support their case or they may insure it is scrubbed before producing documents to opposing counsel.

When selecting a vendor or software to scrub documents it is important to insure that the last 10 authors is removed during scrubbing. Not all vendors or software applications will identify and remove the last 10 authors data.

In summary, last 10 authors is referred to as metadata, however, it isn't accessible through most computer forensic software or electronic discovery application. Last 10 authors data can be viewed and scrubbed using applications from Pinpoint Labs (Pinpoint MetaViewer, MetaDiscover). There are a couple other applications, however, the applications from Pinpoint Labs can access and scrub the data without altering the file system timestamps and is significantly quicker than other applications reviewed.

Article Source: http://www.articles.ask-me-about.com

About the author: Jon Rowe is the President of Pinpoint Labs and a Certified Computer Examiner. To learn more about Pinpoint Labs click herePinpoint Labs Website - Computer Forensics Software and Services
This article is available as a unique content article with free reprint rights.