jol
Data Recovery Pro
Posts: 651
Joined: Thu Jan 29, 2015 11:31 pm

Excel in HEX edidor

Mon Jul 04, 2016 10:14 pm

Hi,

Can someone explain how is n excel file encoded ?
1. the attached xls file has been created with excel 2007 and saved as Excel 97-2003 Workbook
2. the format cells has not been changed and left has default (general)
I filled some cells with random data.

Here is the part I don't understand some of the cells can be be seen in HEX editor and some not
Can someone explain how to find/read/decypher it in HEX ?

Chart:
x = can't be seen in hex
v = can see in hex

Code: Select all

        A.                 B                   C
1.    No. X.             No. X.          No. (like a data) V
2.    Ditto.             Ditto
3.    Letters V.         Letter V
4.    Ditto.             Ditto
5.   
6
7.    Letters X.         Letters X.      No. (Like a date) V
8
9.    Ditto.             Ditto.          No. (Like a date) X
10    ditto              letters V
11.   Ditto.             Letters X
12.   Ditto
Attachments
Book1.xls
(17 KiB) Downloaded 128 times

User avatar
Jared
Forum Admin
Posts: 3510
Joined: Mon Jan 12, 2015 12:32 pm
Location: Providence, RI
Contact: Website Facebook Twitter Skype YouTube Google+

Excel in HEX edidor

Wed Sep 07, 2016 5:43 pm

I see that the cells containing just text are all visible starting down around offset 0x3460. The number values I'd guess are stored completely differently as they are used for math calculations. Probably is more of a binary floating point value rather than an ACII character you could hope to see in HEX.

jol
Data Recovery Pro
Posts: 651
Joined: Thu Jan 29, 2015 11:31 pm

Excel in HEX edidor

Wed Sep 07, 2016 7:15 pm

Jared wrote:I see that the cells containing just text are all visible starting down around offset 0x3460.

Not exactly true
A7, A9, A10, A11, B7, B9, and B11 are just text and not visible
On the other hand
Jared wrote:The number values I'd guess are stored completely differently as they are used for math calculations.

A date can also be used as a math calculation (IMHO, never checked) and it is visible (not all of them)

As a matter of fact I was more interested in finding the way its built regarding strings (text)

Return to “Digital Forensics”

Who is online

Users browsing this forum: No registered users and 1 guest