Hosting Provided By

RE: linking a word document to a computer

From: Tom Erik Engeskaug <tomerik.engeskaug(at)archatos.com>
Date: Mon May 26 2003 - 11:47:17 EDT

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> -----Original Message-----
> From: stephen_larson@symantec.com
> [mailto:stephen_larson@symantec.com] Sent: Sunday, May 25, 2003
> 1:55 AM
> To: forensics@securityfocus.com
> Subject: linking a word document to a computer
>
>
>
>
> Hello,

I guess you're thinking about pid_guid. This is supposed to have been removed in versions of Office beginning with 2000 and up.

Warren G. Kruse II and Jay G. Heiser have some good info on it in their book "Computer Forensics - Incident Response Essentials" (ISBN 0-201-70719-5). It will also be covered in a paper I'm writing on Windows investigation basics. Getting the book will probably be faster than waiting for me to finish though ;)

Best Wishes,
Tom Erik Engeskaug
- --
tomerik.engeskaug@archatos.com
or
tomerik@securitynerds.org

PGP key available on request

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0 - not licensed for commercial use: www.pgp.com

iQA/AwUBPtI25wB/tZom2kDIEQLyggCgzdzlG9RtlhWzR82YDVV1zy/hyR0An3je zPpXR2wrS583y2JfkvtSYvNJ
=xrW0
-----END PGP SIGNATURE-----

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (
http://www.grisoft.com).
Version: 6.0.483 / Virus Database: 279 - Release Date: 19.05.2003


-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: 
http://aris.securityfocus.com

Received on Mon May 26 14:52:10 2003

Do you need help?

This message: [ Message body ]
Next message: Matias Bevilacqua: "RE: linking a word document to a computer"
In reply to stephen_larson(at)symantec.com: "linking a word document to a computer"
Next in thread: Matias Bevilacqua: "RE: linking a word document to a computer"
Reply: Matias Bevilacqua: "RE: linking a word document to a computer"

Contemporary messages sorted: [ By Date ] [ By Thread ] [ By Subject ] [ By Author ] [ By messages with attachments ]

This archive was generated by hypermail 2.1.8 : Wed Aug 23 2006 - 14:01:44 EDT