Office 2007 Metadata Processor
This script reads XML-based metadata from entries in the current case that are identified as Office 2007 documents by way of file-extension. The script supports both Microsoft Office Open XML and OpenDocument formats, both of which are a collection of zipped XML-files.
For those documents that are in the Microsoft Office Open XML format, the script will bookmark all data stored in the 'docProps\app.xml\Properties' and 'docProps\core.xml\cp:coreProperties' nodes. For documents that are in the OpenDocument format, the script will bookmark all data in the 'meta.xml\office:document-meta\office:meta' node.
In addition to bookmarking all of the XML metadata for a file, the script will write the most relevant document properties into into the bookmark-comment and a summary spreadsheet, which will be in tab-delimited format. Note that XML attributes and other lower-level XML data will be excluded from this process for the sake of clarity/simplicity: if the provenance of a document is particularly important then the examiner should view the complete set of XML-metadata as captured in the bookmark itself.
Dates and times will be shown as-is. The spreadsheet will contain the true-path of each entry that is processed. If an entry has been mounted prior to running the script then the name of that entry will appear twice in the path: this is a known limitation. The presence of a given property in the summary spreadsheet will indicate that a non-empty value exists for at least one processed document.
This script was developed for use in EnCase training. For more details, please click the following link:
Download Now