Forensic Spreadsheet Review

I am involved with the forensic audit of a spreadsheet. I
am looking to see what I can find that will tell me
whether or not sheets/ranges were deleted from the file.
I just did a Print List of all the Named Ranges in the
model. As expected, their are hundreds of named ranges in
the file that have #REF! errors in them. This tells me
data was deleted. However I do not know exactly what was
deleted.

Are there any other tools I can use via VB or Excel that
help me gleen more information about what was deleted and
even better, when it was deleted?

Thanks

Furthermore, I am seeing remnence of Crystal Ball activity
within the named ranges. Is there any other type of
dignostic I can do to extract further info on previous
Crystal Ball activity in the model?


>-----Original Message-----
>I am involved with the forensic audit of a spreadsheet.
I
>am looking to see what I can find that will tell me
>whether or not sheets/ranges were deleted from the file.
>I just did a Print List of all the Named Ranges in the
>model. As expected, their are hundreds of named ranges
in
>the file that have #REF! errors in them. This tells me
>data was deleted. However I do not know exactly what was
>deleted.
>
>Are there any other tools I can use via VB or Excel that
>help me gleen more information about what was deleted and
>even better, when it was deleted?
>
>Thanks
>.
>

To the best of my knowledge, spreadsheets don't store version information.
If you want to learn the Microsoft Compound Document format and the Binary
Interchange File Format (BIFF), then you might be able to discover that
there is some history there - I don't know because I have never tried it.
There could be wealths of knowledge there or nothing - again, I don't know,
but there is no interface provided in Excel to access past versions of the
document (I believe Word has this). The only other history mechanism that I
am aware of is if a file is shared.

Most people that I am aware of store a copy of the file and compare the new
one to the old one for this type of analysis.

--
Regards,
Tom Ogilvy



"ExcelMonkey" <anonymous@discussions.microsoft.com> wrote in message
news:0b8c01c52f9e$9a81c020$a601280a@phx.gbl...
> Furthermore, I am seeing remnence of Crystal Ball activity
> within the named ranges. Is there any other type of
> dignostic I can do to extract further info on previous
> Crystal Ball activity in the model?
>
>
> >-----Original Message-----
> >I am involved with the forensic audit of a spreadsheet.
> I
> >am looking to see what I can find that will tell me
> >whether or not sheets/ranges were deleted from the file.
> >I just did a Print List of all the Named Ranges in the
> >model. As expected, their are hundreds of named ranges
> in
> >the file that have #REF! errors in them. This tells me
> >data was deleted. However I do not know exactly what was
> >deleted.
> >
> >Are there any other tools I can use via VB or Excel that
> >help me gleen more information about what was deleted and
> >even better, when it was deleted?
> >
> >Thanks
> >.
> >

All I have is one version of the file. I have been doing
some reading on Hex Editors but not sure if I have the
time to get up to speed on this. This is not an issue
regarding passwords. The file opens fine and I can see
everything. But the file has many VBA modules (40) that
are now empty (deleted) and plethora of named ranges with
errors. I am trying to ascertain if I have the original
version.


>-----Original Message-----
>To the best of my knowledge, spreadsheets don't store
version information.
>If you want to learn the Microsoft Compound Document
format and the Binary
>Interchange File Format (BIFF), then you might be able to
discover that
>there is some history there - I don't know because I have
never tried it.
>There could be wealths of knowledge there or nothing -
again, I don't know,
>but there is no interface provided in Excel to access
past versions of the
>document (I believe Word has this). The only other
history mechanism that I
>am aware of is if a file is shared.
>
>Most people that I am aware of store a copy of the file
and compare the new
>one to the old one for this type of analysis.
>
>--
>Regards,
>Tom Ogilvy
>
>
>
>"ExcelMonkey" <anonymous@discussions.microsoft.com> wrote
in message
>news:0b8c01c52f9e$9a81c020$a601280a@phx.gbl...
>> Furthermore, I am seeing remnence of Crystal Ball
activity
>> within the named ranges. Is there any other type of
>> dignostic I can do to extract further info on previous
>> Crystal Ball activity in the model?
>>
>>
>> >-----Original Message-----
>> >I am involved with the forensic audit of a spreadsheet.
>> I
>> >am looking to see what I can find that will tell me
>> >whether or not sheets/ranges were deleted from the
file.
>> >I just did a Print List of all the Named Ranges in the
>> >model. As expected, their are hundreds of named ranges
>> in
>> >the file that have #REF! errors in them. This tells me
>> >data was deleted. However I do not know exactly what
was
>> >deleted.
>> >
>> >Are there any other tools I can use via VB or Excel
that
>> >help me gleen more information about what was deleted
and
>> >even better, when it was deleted?
>> >
>> >Thanks
>> >.
>> >
>
>
>.
>

Just a thought....Any chance that the workbook was ever saved on a network drive? Most networks do full backups weekly and incrementals daily. Also, some network users schedule network backups of their local drives.

Regards,
Ron

Hex editors may be useful if you know what you are looking for and where to
look. In the discovery phase, you would be searching a wheat field with a
magnifying glass.

--
Regards,
Tom Ogilvy


"ExcelMoney" <anonymous@discussions.microsoft.com> wrote in message
news:0bbb01c52fa6$42173160$a601280a@phx.gbl...
> All I have is one version of the file. I have been doing
> some reading on Hex Editors but not sure if I have the
> time to get up to speed on this. This is not an issue
> regarding passwords. The file opens fine and I can see
> everything. But the file has many VBA modules (40) that
> are now empty (deleted) and plethora of named ranges with
> errors. I am trying to ascertain if I have the original
> version.
>
>
> >-----Original Message-----
> >To the best of my knowledge, spreadsheets don't store
> version information.
> >If you want to learn the Microsoft Compound Document
> format and the Binary
> >Interchange File Format (BIFF), then you might be able to
> discover that
> >there is some history there - I don't know because I have
> never tried it.
> >There could be wealths of knowledge there or nothing -
> again, I don't know,
> >but there is no interface provided in Excel to access
> past versions of the
> >document (I believe Word has this). The only other
> history mechanism that I
> >am aware of is if a file is shared.
> >
> >Most people that I am aware of store a copy of the file
> and compare the new
> >one to the old one for this type of analysis.
> >
> >--
> >Regards,
> >Tom Ogilvy
> >
> >
> >
> >"ExcelMonkey" <anonymous@discussions.microsoft.com> wrote
> in message
> >news:0b8c01c52f9e$9a81c020$a601280a@phx.gbl...
> >> Furthermore, I am seeing remnence of Crystal Ball
> activity
> >> within the named ranges. Is there any other type of
> >> dignostic I can do to extract further info on previous
> >> Crystal Ball activity in the model?
> >>
> >>
> >> >-----Original Message-----
> >> >I am involved with the forensic audit of a spreadsheet.
> >> I
> >> >am looking to see what I can find that will tell me
> >> >whether or not sheets/ranges were deleted from the
> file.
> >> >I just did a Print List of all the Named Ranges in the
> >> >model. As expected, their are hundreds of named ranges
> >> in
> >> >the file that have #REF! errors in them. This tells me
> >> >data was deleted. However I do not know exactly what
> was
> >> >deleted.
> >> >
> >> >Are there any other tools I can use via VB or Excel
> that
> >> >help me gleen more information about what was deleted
> and
> >> >even better, when it was deleted?
> >> >
> >> >Thanks
> >> >.
> >> >
> >
> >
> >.
> >

I don't think this will help you as I would bet the information is gone.
AFAIK, Excel saves with the current state, nothing more.

--

HTH

RP
(remove nothere from the email address if mailing direct)


"ExcelMoney" <anonymous@discussions.microsoft.com> wrote in message
news:0bbb01c52fa6$42173160$a601280a@phx.gbl...
> All I have is one version of the file. I have been doing
> some reading on Hex Editors but not sure if I have the
> time to get up to speed on this. This is not an issue
> regarding passwords. The file opens fine and I can see
> everything. But the file has many VBA modules (40) that
> are now empty (deleted) and plethora of named ranges with
> errors. I am trying to ascertain if I have the original
> version.
>
>
> >-----Original Message-----
> >To the best of my knowledge, spreadsheets don't store
> version information.
> >If you want to learn the Microsoft Compound Document
> format and the Binary
> >Interchange File Format (BIFF), then you might be able to
> discover that
> >there is some history there - I don't know because I have
> never tried it.
> >There could be wealths of knowledge there or nothing -
> again, I don't know,
> >but there is no interface provided in Excel to access
> past versions of the
> >document (I believe Word has this). The only other
> history mechanism that I
> >am aware of is if a file is shared.
> >
> >Most people that I am aware of store a copy of the file
> and compare the new
> >one to the old one for this type of analysis.
> >
> >--
> >Regards,
> >Tom Ogilvy
> >
> >
> >
> >"ExcelMonkey" <anonymous@discussions.microsoft.com> wrote
> in message
> >news:0b8c01c52f9e$9a81c020$a601280a@phx.gbl...
> >> Furthermore, I am seeing remnence of Crystal Ball
> activity
> >> within the named ranges. Is there any other type of
> >> dignostic I can do to extract further info on previous
> >> Crystal Ball activity in the model?
> >>
> >>
> >> >-----Original Message-----
> >> >I am involved with the forensic audit of a spreadsheet.
> >> I
> >> >am looking to see what I can find that will tell me
> >> >whether or not sheets/ranges were deleted from the
> file.
> >> >I just did a Print List of all the Named Ranges in the
> >> >model. As expected, their are hundreds of named ranges
> >> in
> >> >the file that have #REF! errors in them. This tells me
> >> >data was deleted. However I do not know exactly what
> was
> >> >deleted.
> >> >
> >> >Are there any other tools I can use via VB or Excel
> that
> >> >help me gleen more information about what was deleted
> and
> >> >even better, when it was deleted?
> >> >
> >> >Thanks
> >> >.
> >> >
> >
> >
> >.
> >

You could try using biffview.exe (part of xl SDK(free download from MS)) but
I think its a bit of lost cause. I dont think the biff spec covers
versioning except in shared workbooks.
you could check for references in vba too Also try listing the names through
vba checking for any hidden ones.

good luck
cheers
Simon

"ExcelMonkey" wrote:

> I am involved with the forensic audit of a spreadsheet. I
> am looking to see what I can find that will tell me
> whether or not sheets/ranges were deleted from the file.
> I just did a Print List of all the Named Ranges in the
> model. As expected, their are hundreds of named ranges in
> the file that have #REF! errors in them. This tells me
> data was deleted. However I do not know exactly what was
> deleted.
>
> Are there any other tools I can use via VB or Excel that
> help me gleen more information about what was deleted and
> even better, when it was deleted?
>
> Thanks
>

"ExcelMonkey" <anonymous@discussions.microsoft.com> wrote in message
news:128a01c52f9d$5868a0b0$a501280a@phx.gbl...
> I am involved with the forensic audit of a spreadsheet. I
> am looking to see what I can find that will tell me
> whether or not sheets/ranges were deleted from the file.
> I just did a Print List of all the Named Ranges in the
> model. As expected, their are hundreds of named ranges in
> the file that have #REF! errors in them. This tells me
> data was deleted. However I do not know exactly what was
> deleted.
>
> Are there any other tools I can use via VB or Excel that
> help me gleen more information about what was deleted and
> even better, when it was deleted?
>
> Thanks

I think the only way to achieve what you want is to get some kind of BIFF
viewer, a utility that examines everything stored in the xls file. A quick
search revealed the eistence of the tools below. You should also know that
Excel may create a backup file.

http://www.eurodownload.com/download...el-viewer.html
http://www.scalabium.com/xls/

/Fredrik