Forensic Spreadsheet Review

[ExcelMonkey]

I am involved with the forensic audit of a spreadsheet. I
am looking to see what I can find that will tell me
whether or not sheets/ranges were deleted from the file.
I just did a Print List of all the Named Ranges in the
model. As expected, their are hundreds of named ranges in
the file that have #REF! errors in them. This tells me
data was deleted. However I do not know exactly what was
deleted.

Are there any other tools I can use via VB or Excel that
help me gleen more information about what was deleted and
even better, when it was deleted?

Thanks

 

[ExcelMonkey]

Furthermore, I am seeing remnence of Crystal Ball activity
within the named ranges. Is there any other type of
dignostic I can do to extract further info on previous
Crystal Ball activity in the model?

 

[Tom Ogilvy]

To the best of my knowledge, spreadsheets don't store version information.
If you want to learn the Microsoft Compound Document format and the Binary
Interchange File Format (BIFF), then you might be able to discover that
there is some history there - I don't know because I have never tried it.
There could be wealths of knowledge there or nothing - again, I don't know,
but there is no interface provided in Excel to access past versions of the
document (I believe Word has this). The only other history mechanism that I
am aware of is if a file is shared.

Most people that I am aware of store a copy of the file and compare the new
one to the old one for this type of analysis.

 

[ExcelMoney]

All I have is one version of the file. I have been doing
some reading on Hex Editors but not sure if I have the
time to get up to speed on this. This is not an issue
regarding passwords. The file opens fine and I can see
everything. But the file has many VBA modules (40) that
are now empty (deleted) and plethora of named ranges with
errors. I am trying to ascertain if I have the original
version.

 

[Tom Ogilvy]

Hex editors may be useful if you know what you are looking for and where to
look. In the discovery phase, you would be searching a wheat field with a
magnifying glass.

 

[Bob Phillips]

I don't think this will help you as I would bet the information is gone.
AFAIK, Excel saves with the current state, nothing more.

--

HTH

RP
(remove nothere from the email address if mailing direct)

 

[Simon Murphy]

You could try using biffview.exe (part of xl SDK(free download from MS)) but
I think its a bit of lost cause. I dont think the biff spec covers
versioning except in shared workbooks.
you could check for references in vba too Also try listing the names through
vba checking for any hidden ones.

good luck
cheers
Simon

 

[Fredrik Wahlgren]

I am involved with the forensic audit of a spreadsheet. I
am looking to see what I can find that will tell me
whether or not sheets/ranges were deleted from the file.
I just did a Print List of all the Named Ranges in the
model. As expected, their are hundreds of named ranges in
the file that have #REF! errors in them. This tells me
data was deleted. However I do not know exactly what was
deleted.

Are there any other tools I can use via VB or Excel that
help me gleen more information about what was deleted and
even better, when it was deleted?

Thanks

I think the only way to achieve what you want is to get some kind of BIFF
viewer, a utility that examines everything stored in the xls file. A quick
search revealed the eistence of the tools below. You should also know that
Excel may create a backup file.

http://www.eurodownload.com/download-software/3740/MS-Excel-viewer.html
http://www.scalabium.com/xls/

/Fredrik