312-49 · Question #447
312-49 Question #447: Real Exam Question with Answer & Explanation
The correct answer is C: the Globally Unique ID. Older versions of Microsoft Office embedded a Globally Unique Identifier (GUID) within documents, which was generated in part using the network adapter's MAC address of the machine that created the file. This meant that documents could be forensically traced back to the specific
Question
Office documents (Word, Excel, PowerPoint) contain a code that allows tracking the MAC, or unique identifier, of the machine that created the document. What is that code called?
Options
- Athe Microsoft Virtual Machine Identifier
- Bthe Personal Application Protocol
- Cthe Globally Unique ID
- Dthe Individual ASCII String
Explanation
Older versions of Microsoft Office embedded a Globally Unique Identifier (GUID) within documents, which was generated in part using the network adapter's MAC address of the machine that created the file. This meant that documents could be forensically traced back to the specific workstation that authored them. This privacy issue gained notoriety after it was discovered that the original Melissa macro virus author was identified this way. Microsoft later changed this behavior in newer Office versions to use a random GUID instead of one derived from the MAC address. For forensic investigators, GUIDs in Office documents can be valuable metadata artifacts.
Topics
Community Discussion
No community discussion yet for this question.