Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I try to find out the structure of encrypted office files (I'd like to implement something like a carving tool for finding certain encrypted file types). I try to understand the Office Document Cryptography Structure Specification but this seems to be very hard, probably because this is too MS specific. What I found out is that when encrypting DOCX-Files, the file header changes from 50 4B 03 04 (typical docx-header) to D0 CF 11 E0 (typical doc header). Within the file I found a XML-File describing the used algorithm, key length, MACs, etc (XmlEncryptionDescriptor). Does anybody know the general structure and how it changes when encrypting?

I hope this question is not too specific.

share|improve this question
add comment

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.