[LINK] Seeking expert on Microsoft Word binary file format

[Adam Todd]

Yes WORD tracks the time a document is open by the time it's sitting 
there, not the time you spend between active key presses.

Active Key Presses is the time between the first keypress and the 
last, excluding any period of time longer than the average time it 
takes to press two sequential key.

So with word you can leave the document open, hibernate for several 
days and you will have a document that has been edited for several 
days.  I gave up using this method for tracking editing on scripts 
for the very reason that people kept leaving the script open on their 
desktop for days, even weeks and it provided me with no useful information.

Words Editing time is also accumulative.  So if you open it for one 
hour every day for 30 days, the time will be 30 hours.

Trying to prove a document was edited for "x minutes" because words 
"Summary" says it was so long is worthless.

Not to mention, that if you COPY the file to a new file name, the 
data resets, including version number and number of edits.

However if you SAVE AS, you will simply accumulate the revision 
number and minutes into the SAVE AS document.

The only thing you can prove from such data is that the document was 
open in word for X minutes, and it was opened Y times.

You may be able to acquire a CREATION and PRINT DATE but these are varied too.

If the evidential requirement of an expert witness is required I may 
be able to help, feel free to contact me.


At 08:56 02/07/2008, Michael Still wrote:
>Michael Still wrote:
> > Jeremy Malcolm wrote:
> >
> >> This is in relation to a criminal case where those values may be
> >> important to the client's defence, in that the police are relying on
> >> the "total editing time" as evidence of how long the client had the
> >> document open.  It could be an interesting assignment.
> >>
> >> Please let me know if you are interested.
> >
> > Is this the same total editing time that is reported via ODMA if a
> > provider is registered? The ODMA specification might provide you to some
> > more pointers on the vagaries of such a statistic.
>
>Yeah, they do look related:
>
>ODMSTATUS ODMCloseDoc( ODMHANDLE odmHandle, LPSTR lpszDocId, DWORD
>activeTime, DWORD pagesPrinted, LPVOID sessionData, WORD dataLen )
>
>An application that has opened a document by calling ODMOpenDoc must
>call ODMCloseDoc when it is finished using the document. The application
>should not call this function until after it has closed the document,
>because the DMS may move the document or make it inaccessible as a
>result of this call. Note that this function will not cause the document
>to be saved into the DMS's persistent repository unless ODMSaveDoc has
>been called previously.
>Parameters:
>
>[snip]
>
>activeTime - in - If the application tracks time spent editing the
>document then it should pass the number of seconds here. Otherwise it
>should pass 0xFFFFFFFF.
>
>(From the ODMA specification at http://odma.info/downloads/odma10-2.htm)
>
>So, it should be a "simple" case of opening a document and ignoring it
>for a bit and seeing what that number ends up being. I strongly suspect
>that the value is a simple counter of number of seconds the document is
>open, even if the document doesn't have focus.
>
>Mikal
>_______________________________________________
>Link mailing list
>Link at mailman.anu.edu.au
>http://mailman.anu.edu.au/mailman/listinfo/link