I am involved with the forensic audit of a spreadsheet. I
am looking to see what I can find that will tell me
whether or not sheets/ranges were deleted from the file.
I just did a Print List of all the Named Ranges in the
model. As expected, their are hundreds of named ranges in
the file that have #REF! errors in them. This tells me
data was deleted. However I do not know exactly what was
deleted.

Are there any other tools I can use via VB or Excel that
help me gleen more information about what was deleted and
even better, when it was deleted?

Thanks

Furthermore, I am seeing remnence of Crystal Ball activity
within the named ranges. Is there any other type of
dignostic I can do to extract further info on previous
Crystal Ball activity in the model?


-----Original Message-----
I am involved with the forensic audit of a spreadsheet.
I
am looking to see what I can find that will tell me
whether or not sheets/ranges were deleted from the file.
I just did a Print List of all the Named Ranges in the
model. As expected, their are hundreds of named ranges
in
the file that have #REF! errors in them. This tells me
data was deleted. However I do not know exactly what was
deleted.

Are there any other tools I can use via VB or Excel that
help me gleen more information about what was deleted and
even better, when it was deleted?

Thanks
.

To the best of my knowledge, spreadsheets don't store version information.
If you want to learn the Microsoft Compound Document format and the Binary
Interchange File Format (BIFF), then you might be able to discover that
there is some history there - I don't know because I have never tried it.
There could be wealths of knowledge there or nothing - again, I don't know,
but there is no interface provided in Excel to access past versions of the
document (I believe Word has this). The only other history mechanism that I
am aware of is if a file is shared.

Most people that I am aware of store a copy of the file and compare the new
one to the old one for this type of analysis.

--
Regards,
Tom Ogilvy



"ExcelMonkey" wrote in message
...
Furthermore, I am seeing remnence of Crystal Ball activity
within the named ranges. Is there any other type of
dignostic I can do to extract further info on previous
Crystal Ball activity in the model?


-----Original Message-----
I am involved with the forensic audit of a spreadsheet.
I
am looking to see what I can find that will tell me
whether or not sheets/ranges were deleted from the file.
I just did a Print List of all the Named Ranges in the
model. As expected, their are hundreds of named ranges
in
the file that have #REF! errors in them. This tells me
data was deleted. However I do not know exactly what was
deleted.

Are there any other tools I can use via VB or Excel that
help me gleen more information about what was deleted and
even better, when it was deleted?

Thanks
.

All I have is one version of the file. I have been doing
some reading on Hex Editors but not sure if I have the
time to get up to speed on this. This is not an issue
regarding passwords. The file opens fine and I can see
everything. But the file has many VBA modules (40) that
are now empty (deleted) and plethora of named ranges with
errors. I am trying to ascertain if I have the original
version.


-----Original Message-----
To the best of my knowledge, spreadsheets don't store
version information.
If you want to learn the Microsoft Compound Document
format and the Binary
Interchange File Format (BIFF), then you might be able to
discover that
there is some history there - I don't know because I have
never tried it.
There could be wealths of knowledge there or nothing -
again, I don't know,
but there is no interface provided in Excel to access
past versions of the
document (I believe Word has this). The only other
history mechanism that I
am aware of is if a file is shared.

Most people that I am aware of store a copy of the file
and compare the new
one to the old one for this type of analysis.

--
Regards,
Tom Ogilvy



"ExcelMonkey" wrote
in message
...
Furthermore, I am seeing remnence of Crystal Ball
activity
within the named ranges. Is there any other type of
dignostic I can do to extract further info on previous
Crystal Ball activity in the model?


-----Original Message-----
I am involved with the forensic audit of a spreadsheet.
I
am looking to see what I can find that will tell me
whether or not sheets/ranges were deleted from the
file.
I just did a Print List of all the Named Ranges in the
model. As expected, their are hundreds of named ranges
in
the file that have #REF! errors in them. This tells me
data was deleted. However I do not know exactly what
was
deleted.

Are there any other tools I can use via VB or Excel
that
help me gleen more information about what was deleted
and
even better, when it was deleted?

Thanks
.



.

Hex editors may be useful if you know what you are looking for and where to
look. In the discovery phase, you would be searching a wheat field with a
magnifying glass.

--
Regards,
Tom Ogilvy


"ExcelMoney" wrote in message
...
All I have is one version of the file. I have been doing
some reading on Hex Editors but not sure if I have the
time to get up to speed on this. This is not an issue
regarding passwords. The file opens fine and I can see
everything. But the file has many VBA modules (40) that
are now empty (deleted) and plethora of named ranges with
errors. I am trying to ascertain if I have the original
version.


-----Original Message-----
To the best of my knowledge, spreadsheets don't store
version information.
If you want to learn the Microsoft Compound Document
format and the Binary
Interchange File Format (BIFF), then you might be able to
discover that
there is some history there - I don't know because I have
never tried it.
There could be wealths of knowledge there or nothing -
again, I don't know,
but there is no interface provided in Excel to access
past versions of the
document (I believe Word has this). The only other
history mechanism that I
am aware of is if a file is shared.

Most people that I am aware of store a copy of the file
and compare the new
one to the old one for this type of analysis.

--
Regards,
Tom Ogilvy



"ExcelMonkey" wrote
in message
...
Furthermore, I am seeing remnence of Crystal Ball
activity
within the named ranges. Is there any other type of
dignostic I can do to extract further info on previous
Crystal Ball activity in the model?


-----Original Message-----
I am involved with the forensic audit of a spreadsheet.
I
am looking to see what I can find that will tell me
whether or not sheets/ranges were deleted from the
file.
I just did a Print List of all the Named Ranges in the
model. As expected, their are hundreds of named ranges
in
the file that have #REF! errors in them. This tells me
data was deleted. However I do not know exactly what
was
deleted.

Are there any other tools I can use via VB or Excel
that
help me gleen more information about what was deleted
and
even better, when it was deleted?

Thanks
.



.

I don't think this will help you as I would bet the information is gone.
AFAIK, Excel saves with the current state, nothing more.

--

HTH

RP
(remove nothere from the email address if mailing direct)


"ExcelMoney" wrote in message
...
All I have is one version of the file. I have been doing
some reading on Hex Editors but not sure if I have the
time to get up to speed on this. This is not an issue
regarding passwords. The file opens fine and I can see
everything. But the file has many VBA modules (40) that
are now empty (deleted) and plethora of named ranges with
errors. I am trying to ascertain if I have the original
version.


-----Original Message-----
To the best of my knowledge, spreadsheets don't store
version information.
If you want to learn the Microsoft Compound Document
format and the Binary
Interchange File Format (BIFF), then you might be able to
discover that
there is some history there - I don't know because I have
never tried it.
There could be wealths of knowledge there or nothing -
again, I don't know,
but there is no interface provided in Excel to access
past versions of the
document (I believe Word has this). The only other
history mechanism that I
am aware of is if a file is shared.

Most people that I am aware of store a copy of the file
and compare the new
one to the old one for this type of analysis.

--
Regards,
Tom Ogilvy



"ExcelMonkey" wrote
in message
...
Furthermore, I am seeing remnence of Crystal Ball
activity
within the named ranges. Is there any other type of
dignostic I can do to extract further info on previous
Crystal Ball activity in the model?


-----Original Message-----
I am involved with the forensic audit of a spreadsheet.
I
am looking to see what I can find that will tell me
whether or not sheets/ranges were deleted from the
file.
I just did a Print List of all the Named Ranges in the
model. As expected, their are hundreds of named ranges
in
the file that have #REF! errors in them. This tells me
data was deleted. However I do not know exactly what
was
deleted.

Are there any other tools I can use via VB or Excel
that
help me gleen more information about what was deleted
and
even better, when it was deleted?

Thanks
.



.

"ExcelMonkey" wrote in message
...
I am involved with the forensic audit of a spreadsheet. I
am looking to see what I can find that will tell me
whether or not sheets/ranges were deleted from the file.
I just did a Print List of all the Named Ranges in the
model. As expected, their are hundreds of named ranges in
the file that have #REF! errors in them. This tells me
data was deleted. However I do not know exactly what was
deleted.

Are there any other tools I can use via VB or Excel that
help me gleen more information about what was deleted and
even better, when it was deleted?

Thanks

I think the only way to achieve what you want is to get some kind of BIFF
viewer, a utility that examines everything stored in the xls file. A quick
search revealed the eistence of the tools below. You should also know that
Excel may create a backup file.

http://www.eurodownload.com/download...el-viewer.html
http://www.scalabium.com/xls/

/Fredrik