I believe there are MS Word docs on a Windows 10 system, but that their extensions have been changed to hide them. How can I search the file system, looking at file contents, not extensions, to identify any unlabeled Word docs?
Docs may be .doc or .docx, and may be password-protected.
Looks like grep is the answer. Binary .doc files contain the string Word.Document.8:
"GnuWin32\bin\grep.exe" -a -r "Word.Document.8" c:\Users\alice
Figure out the file signature/magic number for the version of Word document you are looking for. Once you work out how many bytes that is get the first n-bytes from every file using
head -c <number of bytes in signature> <filename>|hexdump then compare the output to the signature you are looking for.
Note this would work on a Linux system, you could boot the system using a Live image of Kali or BackTrack and take advantage of some of the forensics tools built-in there, or just use Debian. This would allow you to use the other tools to look at file modification times, etc to see if large batches of files were modified or renamed. If you think the files have been added/modified maliciously taking a good look at the file system using forensics tools of some sort might be a good idea before allowing it to connect to the network again.
