Sunday, March 7, 2010

Updated Office 2007 Metadata EnScript

Awhile back I wrote an EnScript to bookmark and log all the metadata from Office documents and Excel spreadhseets. The EnScript is using the EnCase internal function to view compound OLE files and just recurses all the evidence and collects all the metadata for quick reporting. You can see the original post here.

I have updated the EnScritpt to now report the metadata in Office 2007 file (docs and xls). The data is now stored in XML and is parsed and reported the same way as the classic Office documents.

This version prints the results to the console, a local text file and a bookmark, if that option is selected.

Download Here

4 comments:

Anonymous Thursday, 14 October, 2010  

Hi! I love the script. My only request would be to change the output so that it is a TSV file (so that it could easily be opened in Excel with one file per row). Would that be an easy change?

Again, thanks for the great script!

Bryan

Anonymous Tuesday, 25 January, 2011  

When I run this on an .doc file that has been expanded (View File Structure) - I get this... ideas?

Error: Function "Close" cannot be called on a constant object
Name: Office Metadata_Includes_Office_2007
Status: Error
Start: 01/25/11 10:12:36AM
Stop: 01/25/11 10:12:45AM
Time: 0:00:09

Lance Mueller Tuesday, 25 January, 2011  

There is no need to mount (view file structure) the doc before you run the EnScript.

Anonymous Thursday, 05 May, 2011  

There is a problem in this script with a cyrillic symbols in a title, author ...
May be it can be fixed?

Thanks you in advance.

Post a Comment

Computer Forensics, Malware Analysis & Digital Investigations

Random Articles