Forensic Analysis of Microsoft office OOXML/OpenXML files using Python

Microsoft started supporting Office Open XML format from Microsoft Office 2007 release onwards.

Office Open XML is also know as OOXML or OpenXML. All office files, say, docx, xlsx, pptx are zipped content of XML files.

In this blog we will try to read find xml files part of the office file archive and look at directory structure. We will parse office files using Python.

Libraries used

        import zipfile, sys
        import libxml2, datetime

zipfile       for parsing zipfile

sys             to use exit() function

libxml2     for parsing XML files

datetime    for printing date/time

Read office file(which is zipped indeed)

file = zipfile.ZipFile(sys.argv[1],"r")

Where sys.argv[1] is the command line argument we pass to the program as shpown below

./office.py file.docx

Loop through all the files and print

        for name in file.namelist():
            print "file name:" + name

To read XML file

        xmlbuf = file.read(name)

file.open() will not work

Read the XML file, we can also use  libxml2.parseMemory(xmlbuf)

        try:
            xmlf = libxml2.parseDoc(xmlbuf)
        except (libxml2.parserError, TypeError):
            print "Error loading core.xml"
            sys.exit()

Get the root element of the XML

        root = xmlf.getRootElement()

coreProperties in the case of core.xml

Call below function with root tag/element as argument

        recursive_find(root)

This is a recursive function which recursively gets all the XML tags.

Entity: line 1: parser error : Start tag expected, '<' not found
docProps/core.xml

To ignore above error use

        def noerr(ctx, str):
            pass
        libxml2.registerErrorHandler(noerr, None)

The error above is the major blocking point.

core.xml file part of the office file archive has details like file creators name, access time, modified time, last modified user's name etc. We will try to extract those values using Python. Apart from core.xml file we also print names, file sizes, time stamps of the files part of the archive.

Final result will look like

http://en.wikipedia.org/wiki/Office_Open_XML
http://www.ecma-international.org/publications/standards/Ecma-376.htm
http://msdn.microsoft.com/en-us/library/dd908153(v=office.12).aspx