MS Word 2013 Reading Locations

[Nytro]

[h=3]MS Word 2013 Reading Locations[/h]Microsoft Office 2013 introduced a new feature that allows a user to continue reading or editing a document starting at the last point he or she was working. This feature, referred to by some as "pick up where you left off", is a convenient way to jump to the location within a document that Word believes was being read or edited most recently before a file was closed. After opening a document and being greeted with the prompt pictured above, I was curious as to where this information is being tracked. After a bit of investigation, I located a set of registry subkeys specific to Office 2013 where this information is stored.

When a document in Word 2013 is closed, a registry subkey is created or updated in the "Software\Microsoft\Office\15.0\Word\Reading Locations" subkey of the current user's NTUSER.DAT. The subkey created should be named something similar to "Document 0", "Document 1", "Document 2", etc., as the number appended to the name of each subkey is incremented by one when a new document is closed. Each "Document #" subkey should contain 3 values that may be of interest to an examiner: "Datetime", "File Path", and "Position". All three values are stored as null-terminated Unicode strings.

[TABLE=class: tr-caption-container]

[TR]

[TD=align: center][/TD]

[/TR]

[TR]

[TD=class: tr-caption, align: center]Screenshot of Reading Locations Subkey[/TD]

[/TR]

[/TABLE]

Datetime Value

The Datetime value corresponds to the local date and time the file was last closed. This value data is displayed in the format YYYY-MM-DD, followed by a "T", then HH:MM.

File Path Value

The File Path value is the fully qualified file name.

Position Value

The Position value appears to store the positioning data used to place the cursor at the point in the document "where you left off". It appears that the second number in this value data is used to denote the location within the document. For example, if a file is opened for the first time and then closed again without scrolling down through the document, the Position value data should be "0 0". If a file is opened and the user scrolls down a bit through the document before closing it, the Position value data may be something like "0 1500". The second number in this value data appears to increase as the user scrolls through (i.e. reads/edits) the document. Note that positioning of the cursor does not seem to have an impact on this value. That is, the second field in this value data increases even if the cursor is never moved from the beginning of the document.

[h=4]Forensic Implications[/h] Fifty unique files (based on fully qualified file name) can be tracked in the Reading Locations subkeys. Each time a document in Word 2013 is closed, regardless of the version of Word that created the file, a Reading Locations subkey should be added or updated. It should be noted, however, that files accessed from a user's SkyDrive do not appear to be tracked in the Reading Locations subkey. If the file referenced by the "File Path" value data of any subkey is opened and closed again, the corresponding value data is updated, however, the organization of the "Document #" subkeys remains unchanged (i.e. "Document 0" is not shifted to "Document 1", etc.). Interestingly, it appears that when the 51st document is opened, the "Document 49" subkey is overwritten, leaving data from the other subkeys untouched. This LIFO rotation may have some interesting effects on examination, as it lends itself to preserving more historical data while recent activity is more likely to be overwritten.

Posted by Jason Hale at 11:51 PM

Sursa: Digital Forensics Stream: MS Word 2013 Reading Locations