Microsoft Compound File
(→Identification) |
(Updated link) |
||
| Line 27: | Line 27: | ||
== Programs, libraries, and utilities == | == Programs, libraries, and utilities == | ||
* [http://www.mitec.cz/ssv.html Structured Storage Viewer] | * [http://www.mitec.cz/ssv.html Structured Storage Viewer] | ||
| − | * [ | + | * [https://github.com/libyal/libolecf/wiki libolecf] |
* [http://www.decalage.info/python/olefileio OleFileIO_PL - a Python module to read MS OLE2 files] | * [http://www.decalage.info/python/olefileio OleFileIO_PL - a Python module to read MS OLE2 files] | ||
* [http://videos.didierstevens.com/2014/08/26/oledump-py-beta/ oledump.py beta] | * [http://videos.didierstevens.com/2014/08/26/oledump-py-beta/ oledump.py beta] | ||
Revision as of 02:00, 8 April 2015
Microsoft Compound File is a complex container format used by some versions of Microsoft Office, and other Microsoft applications. It has features similar to those of a filesystem format.
It is also known as Compound File Binary File Format (CFBF or CFB), Microsoft Compound Document File Format, OLE Compound Document Format, OLE2 Compound Document Format, Composite Document File, etc.
The format was not publicly documented by Microsoft until 2008.
It is (or was?) inofficially known as LAOLA File Format.
Contents |
Identification
Files begin with signature bytes D0 CF 11 E0 A1 B1 1A E1.
Identifying the specific document format is difficult. This is one of the few formats for which the file command resorts to a hard-coded identification algorithm (see readcdf.c).
Related formats
See Category:Microsoft Compound File.
Specifications
Programs, libraries, and utilities
- Structured Storage Viewer
- libolecf
- OleFileIO_PL - a Python module to read MS OLE2 files
- oledump.py beta
- officeparser
- python-oletools - python tools to analyze OLE files
Links
- Wikipedia article
- Forensics Wiki article
- Joel on Software: Why are the Microsoft Office file formats so complicated?
- Some (older) reverse engineered information here and a Perl module here
- Malicious Office macros are not dead
- MS Office 97-2003 legacy/binary formats security - article with lots of resources on MS Office formats, including analysis techniques, tools and parsing libraries
Editors' notes
TODO: Explain the relationship between Compound File format and the format/technology called COM Structured Storage (or OLE Structured Storage).
