MS-Office Forensics

MS Word documents are one of the most commonly used file types. Therefore, extorting textual data from the MS Word document (docx file) can be achieved by decompressing the file. MS-Office Forensics is a tool developed so that it allows investigators to automatically decompress (unzip) the investigated MS Word document. Additionally, it automatically parses and analyzes the contents of the resulted XML files and subfolders. The user can extract various parts such as the document's textual data by paragraphs or by textual data blocks. A block is a sequence of textual data (not a complete paragraph) that is extracted from the XML file. The results of these extracted parts can be saved into simple text files for further analysis, which may incorporate searching for these parts in a RAM dump.