Security

Ask something
Discussion Locked

PID_GUID and MAC Addresses

0 helpful
6 replies

by crucial 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I am researching the technical aspects of the PID_GUID that used to be inserted into Word97 documents (and other files).

I have two documents, each created by the same person. It is claimed that the documents were created 10 months apart while the person was in two different locations, and on two different computers.

However, each MS Word document contains the same MAC Address, which, I am told, means that they were most likely created on the same computer, or at least a computer with the same Network card.

I need to discount all other reasonable explanations. Of course, one is that the creator used a Notebook, but are there others?

Can they have been created on different computers with different Network cards, and still have the same MAC Address?

6 replies

by drinkin and thinkin

There's the possiblity that they were edited on the same machine after being created on different machines.

It's also possible to hack a Word document (using a hex editor) and give it any (or no) MAC address.

by crucial

Thanks 'drinkin', but I am advised that the GUID and MAC address only come from the 'creating' machine. If the document is 'saved as' to a:\ drive, it loses its GUID, but otherwise it is retained in its original format.

I was aware of the abilityto change it later - or remove it.

I have since discovered that the two documents have sequential 'clock sequence' numbers in the GUID. What is the significance of that?

by drinkin and thinkin

Your source is correct about the GUID coming from the 'creating' machine. My mistake.

The clock sequence is incremented each time a GUID is generated. Except in the case of an unknown clock sequence, where a new random clock sequence will be generated. So two GUIDs with 'sequential' clock sequences must have been generated sequentially.

This discussion is closed to new replies.