Digital Forensics New XML-Based Files Implications for Forensics
Two new of!ce document !le formats (Of!ce Open XML and OpenDocument Format) make it easier to glean time stamps and unique document identi!ers while also improving opportunities for !le carving and data recovery.
SIMSON L. or more than 20 years, programs such as Micro- OOX !les using GARFINKEL soft Word have stored their documents in binary Microsoft O"ce US Naval !le formats. That’s changing as Microsoft, Sun 2007 for Windows, Microsoft O"ce 2008 for Ma- Postgraduate Microsystems, and other developers migrate to cintosh, OpenO"ce 2.3.1, and NeoO"ce 2.2.2 (a School Fnew XML-based formats for document !les. version of OpenO"ce that runs under MacOS). We Document !les are of critical interest to forensic analyzed these !les using specially written XMLdoc JAMES J. practitioners because of the data they contain; they’re tools, including an XML ZIP-!le browser, a search MIGLETZ also a rich topic for forensic research. Although most utility, and a program for automatically displaying the US Marine investigations concern themselves solely with a docu- di#erences between two XML-containing ZIP !les. Corps ment’s surface content, some examinations dive deeper, These tools are freely available from our Web site Command examining the metadata or deleted material that’s still (www.a$ib.org). and Control present in the !le. Investigators can, for instance, use For this study, we decided not to evaluate the digital Integration metadata to identify individuals potentially responsible signature provisions of either the ODF or OOX for- Division for unauthorized !le modi!cation, establish text plagia- mats because these features are rarely used in practice. rization, or even indicate falsi!cation of evidence. Un- fortunately, metadata can also be modi!ed to implicate Data Recovery innocent people—and the ease of modifying these new Overall, we found that ODF and OOX !les tend to !les means that it’s far easier to make malicious modi!- be smaller than equivalent legacy non-XML !les, al- cations that are di"cult (if not impossible) to detect.1 most certainly a result of ZIP compression. Although With so many aspects to consider, we present a it’s trivial to add to or remove parts from a ZIP archive forensic analysis of the two rival XML-based of- after its creation, we found that in many cases, adding !ce document !le formats: the O"ce Open XML or removing parts to the archive corrupted the !le so (OOX) that Microsoft adopted for its O"ce soft- that it couldn’t be processed with Microsoft O"ce or ware suite and the OpenDocument Format (ODF) OpenO"ce. used by Sun’s OpenO"ce software. We detail how The ZIP structure for these !les is useful when per- forensic tools can exploit features in these !le formats forming data recovery or !le carving. (File carving is and show how these formats could cause problems for the process of recognizing !les by their content, rather forensic practitioners. For additional information on than !le system metadata. Carving is frequently used the development and increased use of these two !le for recovering !les from devices that have hardware formats, see the “Background” sidebar. errors, have been formatted, or have been partially overwritten.) Because each part of the archive includes Analysis and Forensic Implications a multibyte signature and a 32-bit cyclic redundancy To begin our analysis, we created multiple ODF and check (CRC32) for validation, we can recover parts of
38 COPUBLISHED BY THE IEEE COMPUTER AND RELIABILITY SOCIETIES ■ 1540-7993/09/$25.00 © 2009 IEEE ■ MARCH/APRIL 2009
Authorized licensed use limited to: Naval Postgraduate School. Downloaded on January 13, 2010 at 12:09 from IEEE Xplore. Restrictions apply. Digital Forensics
a ZIP archive even when other parts of it are damaged, missing, or otherwise corrupted. We can also use the Length Name CRC32 and relative o#sets within the archive to au------tomatically reassemble fragmented ZIP !les.2 We can 1527 [Content_Types].xml then manually process recovered parts or insert them 735 _rels/.rels into other OOX/ODF !les to view the data. 1107 word/_rels/document.xml.rels 4780 word/document.xml Manifest. ODF and OOX both contain a ZIP direc- 6613 word/media/image1.png tory as the last structure in the !le. We can examine 7559 word/theme/theme1.xml this directory using standard tools, such as the Unix 39832 docProps/thumbnail.jpeg unzip command or Sun’s JAR. 25316 word/embeddings/Microsoft_Word_Document1.docx ODF has a second directory that stores document 2036 word/settings.xml parts in an XML data structure called Meta-INF/ 276 word/webSettings.xml manifest.xml. The OOX !les store references to the 734 docProps/app.xml additional document parts in the [Content_Types]. 726 docProps/core.xml xml and .rels parts, in addition to the document con- 15019 word/styles.xml tents themselves. 1521 word/fontTable.xml ------Contents. Both !le formats include a special XML 107781 14 !les !le that contains the document’s main %ow. In ODF, the !le content is called content.xml. The primary Figure 1. ZIP archive directory. We embedded a Microsoft Word document contents of an OOX word processing document cre- inside another Microsoft Word document with Word’s “Insert/Object...” ated with Microsoft O"ce 2007 or 2008 reside in the command. document.xml part, although the standard allows a di#erent name to be speci!ed in the [Content_Types]. xml part. To this end, we tested both Guidance’s EnCase 6.11 Forensic tools should extract text from the content and AccessData’s Forensic ToolKit 1.8 and determined parts, but tool developers must understand that text that they could display and search for text inside ODF can be present in other document parts as well. For !les, OOX !les, and OOX !les embedded as objects example, Microsoft Word allows other Word docu- inside other OOX !les. ments to be embedded within a Word document us- Both the compressed nature of ODF and OOX ing the “Insert/Object...” menu command. These !les and the multiple codings for the strings pos- documents are embedded as a named .docx !le inside sible within XML represent a signi!cant problem the ZIP archive, as Figure 1 shows. In such an in- for forensic program developers. Because all the text stance, where !les are embedded within other !les, is compressed, it’s no longer possible to !nd it by investigators should analyze !les recursively using a scanning for strings within raw disk or document special forensic tool. images. And because XML allows strings to be cod- The most straightforward way for forensic prac- ed in hexa decimal or even interrupted by comment titioners to handle these new compound document characters (for example, str<--! ignore-->ing), formats is to save the !le and then open it with a any forensic tool that takes shortcuts in decoding compliant program. Although this approach works, it the ZIP archive or implementing the full XML raises several potential problems: schema could return false negatives when perform- ing searches. rThe compound document might contain active content that the forensic investigator doesn’t wish Embedded objects and thumbnails. A big advantage to execute. (Despite assurances from Microsoft and of these XML !le formats is that images and other others that these !le formats are safer, both ODF objects embedded in word processing !les are stored and OOX have provisions for storing active con- in the ZIP !le as their own parts. tent3 and therefore can carry viruses.) We found that Microsoft O"ce 2008 and Neo- rLinks to external Web sites can reveal that someone O"ce for Macintosh both stored thumbnail images has captured the !le and is analyzing it. of the documents’ !rst page by default: Microsoft rIf parts of the !le are overwritten or missing, appli- stores the thumbnail as a .jpg, while NeoO"ce stores cations such as Word or OpenO"ce might be un- it as two !les—a .png and a .pdf. We also found .pptx able to open the !les. thumbnails created by PowerPoint 2007 on Win- rDesktop applications can overlook or ignore critical dows. However, Word 2007 and Excel 2007 didn’t information of interest to the forensic investigator. save thumbnails by default, presumably because the
www.computer.org/security 39
Authorized licensed use limited to: Naval Postgraduate School. Downloaded on January 13, 2010 at 12:09 from IEEE Xplore. Restrictions apply. Digital Forensics
Background
ocument !les are fundamentally container !les—that is, sin- pressed; embedded images are stored as binary objects within D gle !les (a consecutive stream of bytes) that contain multiple their own parts. data objects. A typical Microsoft Word !le might contain data Because Microsoft’s XML languages are de!ned in terms of streams associated with the summary info, the main text, tables, behaviors built in to Microsoft Of!ce, OOX !les can’t be readily and embedded images. The !le also contains numerous forms of translated into ODF or vice versa. metadata—both for the document and for the container itself. Microsoft’s Of!ce 2003 allowed these formats to be used as alternative document !le formats; with Microsoft Of!ce 2007, the OpenDocument Format XML-based document formats became the default !le format.3 Sun Microsystems submitted the OpenOf!ce OpenDocument Native support for Of!ce Open XML is provided today in Micro- Format (ODF) to the Organization for the Advancement of Struc- soft Of!ce 2007 for Windows and Of!ce 2008 for Macintosh. tured Information Standards (Oasis). The ODF was approved as Additionally, several other programs have the ability to read or an Oasis standard on 1 May 20051 and adopted as ISO 26300 the write Word 2007 !les. following year. Because of the verbose nature of XML, ODF calls for the XML Implications of ZIP for Of!ce Documents !le to be compressed. Parsing XML can also be time-consuming, ZIP !les consist of one or more !le sections followed by a central so ODF uses a single document represented by multiple XML directory. Each !le section consists of a local !le header that !les bundled together into a single ZIP archive. Images and other includes metadata such as the !le’s directory and !lename, time binary objects aren’t coded as XML but are stored natively as stamp, compression method used, and additional information, binary sections in the ZIP archive. followed by the actual !le data and a data descriptor that in- cludes a 32-bit checksum. The Central Directory Record contains Microsoft’s Of!ce Open XML the names of all the !les, their offsets within the !le, and their Following the introduction of ODF, Microsoft introduced its own time stamps.4 XML-based document !le formats called WordprocessingML, The new XML-based !le formats have several advantages SpreadsheetML, and PresentionML.2 Like ODF, Of!ce Open XML when compared with binary !le formats: (OOX) is a ZIP archive !le consisting of multiple XML document elements (unless the !le is encrypted, in which case it’s an OLE tBecause they’re compressed, !les in the new format are typi- compound !le). Microsoft refers to the !le as a package, with cally smaller than !les in the legacy format. each !le within the archive referred to as a part. 3 As with ODF, tPrograms that process document !les need only extract the structured information is !rst encoded into XML and com- sections that they’re concerned with and can ignore the rest.
tor some idea of the !le’s contents before the !le was 13 0 obj damaged. The thumbnail can also give a sense of what < the document is about if the document !le itself is /Producer
“Save preview picture” on the “Advanced Options” Ownership Attribution for the “Save” dialog box isn’t checked by default on and Unique Identifiers Word and Excel 2007 the way it is in PowerPoint. Unique identi!ers stored within documents can play Embedded thumbnails can be valuable in forensic an important role in many forensic investigations. practice. If the thumbnail doesn’t match the docu- Because unique identi!ers remain the same even ment, then someone modi!ed the thumbnail or the when the document is edited, we can use them to document after the !le’s creation. If the !le is no lon- track the movement of documents through or be- ger intact, the thumbnail might give the investiga- tween organizations. By correlating unique identi!-
40 IEEE SECURITY & PRIVACY
Authorized licensed use limited to: Naval Postgraduate School. Downloaded on January 13, 2010 at 12:09 from IEEE Xplore. Restrictions apply. Digital Forensics
Table 1. Prevalence of various !le types, as determined using Google.
FILE TYPE LEGACY OPEN OFFICE XML OPENDOCUMENT FORMAT Word processing 3/08 .doc 34,900,000 .docx 29,500 .odt 54,800 7/08 .doc 35,500,000 .docx 48,900 .odt 64,800 9/08 .doc 41,500,000 .docx 86,100 .odt 82,500 1/09 .doc 52,200,000 .docx 163,000 .odt 114,000 Spreadsheet 3/08 .xls 6,810,000 .xlsx 5,980 .ods 12,300 7/08 .xls 8,510,000 .xlsx 8,880 .ods 13,400 9/08 .xls 9,310,000 .xlsx 14,700 .ods 16,700 1/09 .xls 11,500,000 .xlsx 52,000 .ods 24,900 Presentation 3/08 .ppt 4,790,000 .pptx 11,900 .odp 17,900 7/08 .ppt 5,540,000 .pptx 21,000 .odp 24,800 9/08 .ppt 6,020,000 .pptx 31,500 .odp 26,600 1/09 .ppt 7,730,0 0 0 .pptx 57,300 .odp 37,700
tOnly sections that could contain computer viruses need to be creasing. We performed Google searches by !le type in March, July, scanned for computer viruses. and September 2008, as well as January 2009 (see Table 1), and tEven if parts of the !le are corrupted, complete ZIP sections can saw the number of OOX !les nearly triple during this study period. still be recovered. This could allow embedded images or even content to be recovered under some circumstances. References 1. M. Brauer et al., Open Document Format for Of!ce Applications v. 1.0, Existing tools for handling ZIP !les and XML documents make it Oasis speci!cation, 1 May 2005; www.oasis-open.org/committees/ easier for developers to write programs that can automatically pro- download.php/12572/OpenDocument-v1.0-os.pdf. cess data stored in XML document !les than to process legacy Word 2. Overview of WordprocessingML, tech. report, Microsoft, 2008; http:// documents. However, because these are ZIP !les of XML documents, msdn2.microsoft.com/en-us/library/aa212812(of!ce.11).aspx. they’re far easier to modify. With off-the-shelf tools, an attacker can 3. F. Rice, Introducing the Of!ce (2007) Open XML File Formats, tech. re- open one of these !les and selectively add or remove information. port, Microsoft, 2008; http://msdn2.microsoft.com/en-us/library/aa 338205.aspx. Frequency of ODF and OOX 4. P. Katz, Appnote.txt—.Zip File Format Speci!cation, PKWare, 28 Sept. Both ODF and OOX are still relatively rare, but their numbers are in- 2007; www.pkware.com/documents/casestudies/Appnote.txt. ers found on multiple hard drives, it’s possible to !nd
www.computer.org/security 41
Authorized licensed use limited to: Naval Postgraduate School. Downloaded on January 13, 2010 at 12:09 from IEEE Xplore. Restrictions apply. Digital Forensics
ciously implicate an innocent computer user or create termine what !les someone saw or modi!ed within the appearance of a false correlation. a certain time period. We can imagine two uses of these unique iden- Both ODF and OOX contain numerous internal ti!ers for a forensic examiner. First, it’s possible to time stamps indicating the time that documents were determine the document’s editing history, even if created or modi!ed. Time stamps are present in the change tracking isn’t enabled. Second, it should be ZIP archive itself, in the embedded XML !les, and possible to generate a database of revision identi!ers potentially in other embedded objects (for example, that appeared in documents distributed by an orga- in the EXIF headers of embedded JPEGs). Although nization under investigation. An automated forensic these time stamps are artifacts of the ZIP !le creation analysis tool could use such a database to generate an and aren’t displayed by O"ce applications to the user, alert whenever an analyst discovers documents with they nevertheless have the potential to retain some in- this type of identi!er on captured media or observes it formation about the ZIP !le’s creation and thus could traveling over a network. be useful in a forensic investigation. To verify this hypothesis, we created a Word We examined the ZIP !les created by NeoOf- 2007 document with three paragraphs and saved the !ce and OpenO"ce and found that the times set for document. We reopened the package, added another the !les’ time stamps within the ODF ZIP archive paragraph, and saved the document again under a matched the system clock. The system expressed the new name. We then repeated this process to cre- time in GMT, without a local time zone correction. ate a third document. By examining the di#erences Microsoft Word and Excel, on the other hand, set the within the ZIP archives, we found the rsidR values time stamp on the !les within the OOX ZIP archive remained consistent for the common paragraphs in to be 1 January 1980 (the epoch of the Microsoft !le each document. allocation table [FAT32] system). Word 2007’s well-hidden “Trust Center” lets users In addition to these ZIP directory time stamps, we disable the storage of revision identi!ers in documents found many other time stamps embedded within vari- by unclicking the option “Store Random Number to ous XML sections: Improve Combine Accuracy.” Microsoft’s choice of language to describe this feature is quite unrevealing; rWord 2007, Excel, and PowerPoint put the docu- a commentator named Brian Jones noted on Micro- ment’s creation date in the dcterms:created tag soft’s blog that a better word for this option would be of the core.xml !le. All three coded the modi!ed “Enable Anonymous Edit Tracking.” date in the dcterms:modified element of the The OOX documents also include a store item ID same !le. that is used to distinguish between custom-created r PowerPoint 2007 coded the document’s creation date pieces and to ensure that data is bound to the cor- in each slideLayoutn.xml !le’s a:fld XML tag. rect location.6 We can use this identi!er in a tracking rWhen we enabled change tracking in Word 2007, manner similar to a revision identi!er. the XML !le annotated multiple w:ins tags. Each Additionally, we found unique identi!ers in each tag included a w:author attribute with the editor’s PowerPoint slideLayoutN.xml !le created from both name, a w:date attribute with the date of the mod- O"ce 2007 and 2008. People frequently create new i!cation, and a w:id attribute with the modi!ca- PowerPoint presentations by starting with an old one tion’s ID number. and changing the slides. Because the PowerPoint .pptx rNeoO"ce encoded the document’s creation date format maintains all of the slide layouts, an investiga- in the meta:creation-date tag of the meta.xml tor could trace presentations that have moved through section contained within the blank OpenDocument organizations by the presence of nonstandard layouts presentation, spreadsheet, and text (ODP, ODS, and added or by changes to the default layouts. ODT) !les we made. We weren’t able to observe any unique identi!ers rNeoO"ce likewise embedded a thumbnail.pdf !le in the ODF documents. inside the blank ODP, ODS, and ODT !les we made. This .pdf !le included comments for a cre- Time Information ation date, as Figure 2 shows. Time is frequently of critical importance in foren- rNeoO"ce embedded the date in a text:date sic investigations. Even though the clock on a sus- tag within the styles.xml of a blank presentation pect’s computer can’t be trusted, they’re frequently we made. correct (especially on computers that set their time automatically over the Internet). Even when a clock These time stamps might be signi!cant in a forensic is wrong, most clocks nevertheless run at more or examination—for example, they might show when less an even rate.7 Thus, forensic examiners can fre- someone edited an ODF or OOX !le with an ODF/ quently use !le modi!cation and access times to de- OOX-aware application. Or the time stamps might
42 IEEE SECURITY & PRIVACY
Authorized licensed use limited to: Naval Postgraduate School. Downloaded on January 13, 2010 at 12:09 from IEEE Xplore. Restrictions apply. Digital Forensics
indicate multiple editing sessions. Alternatively, they r meta:editing-cycles—the number of times might indicate a tampered document. someone edited the document; The time stamps of ODF !les are particularly rele- r meta:user-defined—user-de!nable metadata vant to !le carving because all the time stamps for !les (in our case, tags with the values Info 1 through within each ZIP archive are the same and, in practice, Info 4); and will likely di#er from the time stamps in other ZIP r meta:document-statistics—including the archives on the same hard drive. Consequently, we number of tables, images, objects, page count, para- can use these time stamps as a unique identi!er for a graph count, word count, and character count. particular ODF !le, which in turn allows us to !nd fragmented ODF !les even when the !les are corrupt; The OOX format stores encrypted !les as OLE in many cases, we can intelligently reassemble them. compound !les that have the same .docx, .xlsx, or .pptx !le extension.8 The popular 7-Zip decompres- Hiding Data sion application (www.7-zip.org) can read these !les There are several approaches for hiding data in ODF and extract the following encrypted segments: and OOX !les from forensic analysis, including tradi- tional encryption and the use of comment !elds. [6]DataSpaces [6]DataSpaces/DataSpaceInfo Encryption [6]DataSpaces/DataSpaceInfo/ Both OpenO"ce and Microsoft O"ce make it pos- StrongEncryptionDataSpace sible to save !les with encryption so that the user must [6]DataSpaces/DataSpaceMap provide a password to open a document. We created [6]DataSpaces/TransformInfo encrypted documents containing simple text and with [6]DataSpaces/TransformInfo/ embedded photographs using both OpenO"ce and StrongEncryptionTransform Microsoft O"ce. [6]DataSpaces/TransformInfo/ ODF and OOX take fundamentally di#erent ap- StrongEncryptionTransform/[6]Primary proaches to encrypting documents. ODF applies [6]DataSpaces/Version encryption to some of the speci!c segments of the EncryptedPackage document !le, leaving other segments unencrypted. EncryptionInfo The ZIP metadata and directory information, for ex- WordDocument ample, remain unencrypted. However, all the docu- ment content parts are encrypted, including these Examining these !les revealed their encryption us- ZIP sections: ing the Rivest, Shamir, and Adleman (RSA) and Ad- vanced Encryption Standard (AES) algorithms with a rcon!gurations2/accelerator/current.xml, 128-bit key. We didn’t attempt further cryptanalysis. rcontent.xml, rsettings.xml, Hiding Data in Comments rstyles.xml, We identi!ed several opportunities for hiding data in rpictures/image.png, ODF and OOX !les using comments. The !rst ap- rthumbnails/thumbnail.pdf, and proach doesn’t work well; the second and third do: rthumbnails/thumbnail.png. 1. Adding sections to the ZIP archive. When Microsoft These sections were present and unencrypted: Word encounters a !le modi!ed in this manner, it reports that the archive is corrupted and provides rMeta-INF/manifest.xml, an option to recover its data. NeoO"ce, on the rmeta.xml, and other hand, silently ignores these additional sec- rmimetype. tions and opens the ODF !le. 2. Placing comments directly into the ZIP archive using The lack of encryption could potentially leak the the comment feature that the ZIP !le format provides. values for XML tags that might be relevant to an We tested O"ce 2007, 2008, and NeoO"ce and investigation: found that these programs appear to ignore ZIP comments when the !les are read. When the !les r meta:generator—the speci!c build of the spe- are written back out, the application strips the ci!c application that created the document; comments. r meta:creation-date—the document’s creation 3. Adding comments to the XML !les as XML comments. date in local time; The programs we tested ignored the data stored rdc:language—the document’s primary language; as XML comments. Once again, when !les with
www.computer.org/security 43
Authorized licensed use limited to: Naval Postgraduate School. Downloaded on January 13, 2010 at 12:09 from IEEE Xplore. Restrictions apply. Digital Forensics
These comment !elds are of concern for forensic References analysis because, while many document formats allow 1. S. Rodriguez, “Microsoft O"ce XML Formats? for embedded comments, the forensic tools we test- Defective by Design,” Aug. 2007; http://ooxmlis ed ignore comments stored in ODF and OOX !les. defectivebydesign.blogspot.com/2007/08/microsoft Someone can therefore use embedded comments as a -o"ce-xml-formats-defective.html. channel for covert communications, which is particu- 2. S. Gar!nkel, “Carving Contiguous and Fragmented larly attractive because processing the !le with Word Files with Fast Object Validation,” Digital Investiga- may inadvertently remove the covert information. tion, 2007; www.dfrws.org/2007/proceedings/p2 We created a tool called docx-steg.py for hiding -gar!nkel.pdf. arbitrary !les in Microsoft .docx documents and re- 3. P. Lagadec, “Openo"ce/Opendocument and MS covering them at a later time. Our tool takes the !le, O"ce 2007/Open XML Security,” Proc. Paci!c Secu- encrypts it, base64 encodes it, and stores it as a com- rity Conf., 2006; http://pacsec.jp/psj06/psj06lagadec ment inside one of the !le’s XML sections. This tool is -e.pdf. also available for download from our Web site. 4. S. Gar!nkel, “Forensic Feature Extraction and Cross- Drive Analysis,” Proc. 6th Ann. Digital Forensic Research Workshop, Elsevier, 2006; www.dfrws.org/2006/ espite the fact that Sun Microsystems and Micro- proceedings/10-Gar!nkel.pdf. D soft have submitted the ODF and OOX speci!- 5. Ecma-376 Standard, O"ce Open XML File Formats, Dec. cations to standards bodies, surprisingly few technical 2008; www.ecma-international.org/publications/ articles have published details about the new XML standards/Ecma-376.htm. document !le formats, and virtually nothing has been 6. P. Aven, “A Final ‘Word’: Part 6 in a Series on Mark- published regarding their forensic implications. This logic Servers and O"ce 2007,” 22 Jan. 2008; http:// might be in a case where the forensic analysis depends xqzone.marklogic.com/columns/smallchanges. on particular aspects of the XML or speci!c applica- 7. F. Buchholz and B. Tjaden, “A Brief Study of Time,” tion software behaviors. Proc. 7th Ann. Digital Forensics Research Workshop, El- XML is frequently called self-documenting, but sevier, 2007; www.dfrws.org/2007/proceedingsp31 that’s only the case when tags and attributes have -buchholz.pdf. names that are easy to !gure out. Unfortunately, most 8. [Ms-o#crypto]: O"ce Document Cryptography Structure information gleaned from inspection is unlikely to Speci!cation, Microsoft, 27 June 2008; http://msdn. withstand scrutiny in court: opposing counsel will microsoft.com/en-us/library/cc313071.aspx. almost certainly demand a clear formal documenta- tion if a case depends on an XML tag’s interpretation. Simson L. Gar!nkel is an associate professor at the US Naval Consider the XML fragment we show in Figure 4. Postgraduate School in Monterey, California, and an asso- Just because the a:fld tag appears to have a unique ciate of the School of Engineering and Applied Sciences at identi!er in its id= attribute, it isn’t enough to estab- Harvard University. His research interests include computer lish that it is, in fact, a unique identi!er. forensics, the emerging !eld of usability and security, per- Despite this important caveat, new XML-based sonal information management, privacy, information policy, !le formats o#er many opportunities for forensic ex- and terrorism. aminers to learn about the process by which someone created a speci!c document. Although the informa- James J. Migletz is an enterprise architect for the Operational tion in these new XML !les might also reside in leg- Architecture Branch of the US Marine Corps Command and acy .doc, .xls, and .ppt !le formats, the move to XML Control Integration Division. His research interests include makes this information far more readily accessible. It’s network security and computer forensics. Migletz has an MS our hope that a new generation of forensic tools can in computer science from the Naval Postgraduate School. make programmatic use of this information without He graduated with honors and received the Admiral Grace the need for additional human intervention. Murray Hopper award for academic achievement.
44 IEEE SECURITY & PRIVACY
Authorized licensed use limited to: Naval Postgraduate School. Downloaded on January 13, 2010 at 12:09 from IEEE Xplore. Restrictions apply.