CCSI 330 Week 2 Lab

Finding the Actual Owner of a Document

Overview

Microsoft Word's "metadata", or document properties, stores details about files. Common metadata entries include the document's author, company, title and subject. Each time someone edits and saves a file, Word updates the document's metadata.

Reviewing the document's properties or using the Document Inspector to see if metadata is present and will help you verify what information Word has recorded; remember, though, that the Document Inspector locates the types of metadata recorded in the document but does not reveal what that data contains.

Steps

View Document Properties

1. Open a Word document.

2. Click the File tab.

3. Click "Info".

4. Scroll down to find and click "Show all Properties" to view the metadata entries for the file.

5. Scroll up and find the "Properties" menu, and then click on it to expand.

6. Click the "Advanced Properties" button to open the "Property Window". The "Statistics" tab displays the value of "Last saved by;" as well as date of created, modified, and accessed.

Step 2

Use Document Inspector

1. Open a Word document and then click the "File" tab.

2. Select "Check for Issues" (in some old version of Word, it is under and look under "Preparing for Sharing"), and then click on "Inspect Document" to launch the Document Inspector.

3. Click the check boxes to select the types of metadata the Document Inspector scans for and then click "Inspect." Microsoft Word will display the results of the inspection and provide an option to remove the metadata.

Step 3

Hide and Unhide Text in Word

1. In a Word document, select the text you want to hide. (Welcome to CIS330!)

2. Press Ctrl +D (or click the x icon of the "Font" section on the ribbon). The "Font" window appears.

3. Check the Hidden check box, and then click OK. The select text is now hidden.

Note: To unhide, simply uncheck the "Hidden" check box.

Deliverables

Using any Word document, perform Steps 1-3 to:

1. Investigate a suspicious Word document and find who the actual owner and author is, when the document was created, modified, and accessed, and whether or not there is a hidden text.

2. Document the findings as report.

3. Discuss how the information could possibly provide useful digital evidence(s).

Please be sure to submit your written report.