Fingerprinting of Office 97 files


In Office 97, when an Word, Excel, or PowerPoint file is saved for the first time, it is assigned its own unique serial number. This serial number is the form a 32-digit GUID (Globally Unique ID). The last 12 digits of a GUID will most likely contain the MAC or NIC address of Ethernet adapter of the person saving the document. Since Ethernet addresses are unique, this serial number in theory would allow a document to be traced back to the computer it was created on.

The GUID serial numnber was originally put in Office 97 document files to correct broken hyperlinks. Ironically this feature was never implemented, but the serial numbers remain.

To locate a GUID in a Word document, simply open the .DOC file in Notepad and search for the string "GUID". The GUID serial number will follow immediately in the document.

To fix this problem, Microsoft is providing a patch to Office 97 which will stop putting serial numbers in new document files. For existing files, Microsoft will also be providing a stripper utility for removing serial numbers. Click here for more details.

The Office 97 issue is independent of the operating system and will occur under both Windows 95 and Windows98. There are reports that the problem also exists in Office 98 documents for the Macintosh.

Note that in Office 2000, GUIDs are no longer generated for document files. However a number of GUIDs are included in a file if the document contains VBA macros. There is currently no method of removing these macro GUIDs except to delete the macros themselves.

External Links