The Secret Architecture of Microsoft Office Documents
Since Microsoft Office 2007, formats like Word (`.docx`), Excel (`.xlsx`), and PowerPoint (`.pptx`) are not monolithic binary blobs. Instead, they are standardized Open Packaging Conventions (ISO/IEC 29500) ZIP archives containing a structured directory of XML manifests and embedded resources.
When you rename `report.docx` to `report.zip` and extract its contents, you expose dozens of internal XML documents: `[Content_Types].xml`, `_rels/.rels`, `word/document.xml`, `docProps/core.xml`, `docProps/app.xml`, and `docProps/custom.xml`.
These manifests quietly track organizational information that most users assume is confidential: internal Active Directory usernames, corporate template network paths, exact editing duration down to the minute, and printer configurations.
DOCX, XLSX, and PPTX files are standard ZIP containers. Their internal docProps/ XML manifests record detailed enterprise telemetry.
Forensic Treasure Trove: docProps/core.xml and app.xml
Two specific XML files inside the archive are central to digital forensic investigations:
1. `docProps/core.xml`: Houses Dublin Core metadata elements including `<dc:creator>` (initial author), `<cp:lastModifiedBy>` (last user to save), `<cp:revision>` (numerical revision sequence), `<dcterms:created>`, and `<dcterms:modified>`.
2. `docProps/app.xml`: Contains extended application properties including `<TotalTime>` (cumulative minutes spent editing), `<Company>` (organization registered in Office license), `<Manager>`, `<Application>` (exact Office build, e.g. Microsoft Office Word 16.0000), and `<Template>` (internal corporate file server path).
In corporate espionage and whistleblower cases, analyzing these XML nodes regularly exposes the real identity behind an anonymous leak.
Why Desktop "Inspect Document" Features Often Fall Short
Microsoft Word includes a built-in "Inspect Document" feature, but it requires access to the desktop Office software suite, often leaves residual XML tags, and does not operate on mobile or web-only environments.
Furthermore, third-party web tools that claim to scrub Office files require you to upload your confidential spreadsheets and strategy decks to remote servers. OverlayCheck extracts the ZIP archive directly in browser memory using JSZip, nullifies the XML nodes, and re-compresses the archive locally in milliseconds.
Browser-based zero-knowledge scrubbing unpacks and modifies OpenXML structures locally, preventing confidential documents from touching cloud servers.
Scenario: An anonymous whistleblower released an unredacted Word document exposing internal safety violations at an industrial manufacturer.
Methodology: Forensic investigators extracted `docProps/app.xml`. The `<Template>` tag contained: `\\corp-fs01.internal\templates\qa\john_doe_custom.dotx`.
Outcome & Verdict: The internal network share path explicitly named the individual employee’s workstation and directory, identifying the source within hours. Sanitizing OpenXML metadata beforehand would have eliminated this identifier.
Office Document Sanitization: OverlayCheck vs. Desktop & Cloud Tools
Evaluating privacy architecture, cross-platform availability, and XML scrubbing thoroughness.
| Feature / Dimension | OverlayCheck (Client-Side) | Microsoft Office Desktop GUI | Online Cloud Document Scrubbers |
|---|---|---|---|
| Processing Location | 100% Client-Side In-Browser Memory (JSZip) | Local Computer (Requires Office Installation) | Remote Third-Party Cloud Server |
| License & Software Cost | 100% Free & Open (No Office suite needed) | Requires Microsoft 365 License ($69-$99/yr) | Freemium / Monthly Paywall |
| Document Confidentiality | Zero Data Transfer (0 bytes leave device) | High (Runs locally) | Severe Risk (Uploaded to remote cloud disk) |
| Template Path & Network Scrubbing | Completely purges template paths and server links | Often retains template linkages | Inconsistent across file types |
Command-Line Automation & CLI Workflows
For security engineers and forensic examiners automating pipelines or conducting terminal audits, the equivalent low-level commands can be executed natively:
unzip -p document.docx docProps/core.xml | xmllint --format -Frequently Asked Technical Questions
Q1:Does scrubbing metadata change the formatting or text of my Word document?
No. Scrubbing targets only docProps/core.xml and app.xml. The document body, fonts, tables, styles, and embedded images remain completely unaltered.
Q2:Can someone see who previously modified an Excel spreadsheet after scrubbing?
Once docProps/core.xml is sanitized and <cp:lastModifiedBy> is erased, the file retains no record of previous user identities or editing time.
Q3:Does this remove track changes and revision comments?
Metadata scrubbing cleans file headers and system properties. If your document has active "Track Changes" markup in the text body, you should accept or reject changes prior to scrubbing.