Description |
With the release of Word 97, Microsoft revised the native binary word processing format, which is based on its generic OLE2 Compound Document Format. A Word document is stored as a ‘WordDocument’ stream within a Compound Document Format file. The format remained unchanged with the releases of Word 2000, 2002 and 2003. An alternative extension of .wbk refers to a backup file of a Word document, however there is no material or structural difference between a .wbk file and the .doc file it is a backup of.
Within the 'WordDocument' stream, the byte at position 0x0B deals with encryption/obfuscation, as per the MS FibBase description page - https://msdn.microsoft.com/en-us/library/dd944620(v=office.12).aspx. The first bit (Least Significant Bit (LSB) ordering) specifies whether the file is encrypted, meaning that if the byte at 0x0B is an 'odd' byte (e.g. 01, 03, 05, 07, 09, 0B, 0D, 0F, 11, 13 etc.) then this indicates obfuscation/encryption is present. |