- Nationwide Digital Forensic & Cyber Investigation Services
Examine native Word evidence, test the claimed history, and distinguish technical observations from conclusions about origin and authorship.
Home › Digital Evidence Authentication › Word Document Authentication › DOCX XML Parts and What They Contain
Quick Answer. DOCX XML parts separate document text from styles, settings, numbering, themes, comments, and other resources. The main story usually resides in word/document.xml, but headers, notes, and text in related parts may also matter. Examiners map the relationships and inspect the full package because a text export or normal page view can omit relevant evidence.
This guide belongs to our Word Document Authentication series. Read it alongside DOCX File Structure Explained and DOCX Forgery and AI Fabrication Detection to connect this evidence layer with the wider examination.
| Question | Short answer |
|---|---|
| What does this examination answer? | DOCX XML parts separate document text from styles, settings, numbering, themes, comments, and other resources. The conclusion must be tied to a specific claim about the file rather than an assumption that a normal looking page is genuine. |
| Can the displayed document be trusted by appearance alone? | No. Different packages can produce similar pages, and one package can render differently across applications. Visual consistency is useful context but does not independently establish origin, authorship, or a historical date. |
| Should the original be opened in Word? | Preserve the original first. Use a verified working copy in a controlled environment, with macros and external retrieval disabled. Opening and saving can update properties, links, fields, and package structures. |
| What other records are useful? | Original email attachments, cloud versions, backup copies, and known genuine documents can test the proposed history. Obtain those records independently where possible and document how they were collected. |
| Does missing evidence prove cleaning? | No. Optional features, different writers, conversion, and privacy settings can explain absent artifacts. Evaluate expected behavior against controlled samples and identify the limitations before inferring deliberate removal. |
| Can a hash establish authenticity? | A cryptographic hash verifies whether two byte sequences match and helps track preserved evidence. It does not identify the author, date the original composition, or establish that the statements in a document are true. |
The actual electronic document with its package or binary structures, rather than only a screenshot, printout, or exported page.
The documented origin and handling history that connects a file to a source, account, event, or business process.
A resource within an Open XML package, such as a document story, settings file, property set, or embedded image.
A typed connection from a package or part to another resource. An external target may refer outside the document.
Independent evidence that supports or contradicts an interpretation, rather than another editable field repeating the same assertion.
A separately identified copy used for parsing and rendering experiments while the preserved source remains unchanged.
WordprocessingML organizes content as a tree. In word/document.xml, w:body contains the document body, w:p represents paragraphs, and w:r represents runs that share properties. Text is commonly held in w:t. Run properties appear in w:rPr; section properties in w:sectPr control features such as page size and header references. A sentence can be divided among many runs without any substantive edit.
Reading raw XML as plain text is therefore unsafe. Field instructions, deleted text, tabs, breaks, and alternate representations require context. Formatting can be direct, inherited from a style, or resolved through a theme. Examiners preserve the original XML and distinguish the stored content from the appearance produced by a particular application and configuration.
| Item | Contents or issue | Forensic interpretation |
|---|---|---|
| word/document.xml | w:body, w:p, w:r, w:t, w:rPr, and w:sectPr | Locates disputed text and its structural context. |
| styles.xml | Paragraph, character, table, and other styles | Tests formatting inheritance and reusable document conventions. |
| settings.xml | w:rsids, w:attachedTemplate, w:trackRevisions, w:documentProtection, and w:compat | Provides saved settings, not a complete account of past behavior. |
| fontTable.xml | Declared fonts and related font information | Does not prove that every declared font was used or installed. |
| numbering.xml | Abstract numbering and concrete list definitions | Explains list labels and discontinuities in clauses. |
| webSettings.xml | Web presentation settings | May reflect an application default rather than actual publication. |
| theme/theme1.xml | Theme fonts, colors, and effects | Supports cautious comparison of template generations. |
| header1.xml and footer1.xml | Header and footer stories referenced by sections | Can contain distinct dates, names, and field results. |
| footnotes.xml and endnotes.xml | Note stories and associated text | Finds content omitted from a body only extraction. |
| comments.xml, commentsExtended.xml, and people.xml | Comments and version dependent extension information | May link reviewer identities and comment context when present. |
| word/media | Embedded images with their own file formats | Image metadata and visual assets require separate examination. |
| customXml and glossary document | Structured custom data and reusable building blocks | May retain contextual material not visible in the ordinary page view. |
We scope the examination around the allegation and available source records. Preserve the native file and tell us which date, passage, or origin is disputed before changing or exporting the document.
Request Confidential Consultation Call (833) 292 3733| Observation | What it tests | Limit |
|---|---|---|
| w:compat compatibilityMode | A value such as 15 indicates a compatibility target | It does not uniquely identify the last application version. |
| w:attachedTemplate | A relationship to an associated template | A local or network path can suggest a workflow, not prove access. |
| w:trackRevisions | Saved preference for tracking edits | Its absence cannot establish that tracking was never enabled. |
| Theme fonts | Aptos became the Office default during the 2023 to 2024 transition; Calibri was earlier | A new theme in an allegedly untouched old file merits investigation, not automatic rejection. |
Record the exact part, stream, or record that produced a finding. Preserve the literal value and explain any normalization of time or text. A conclusion should identify the tested hypothesis, the supporting observations, and the alternatives that remain possible. Where software behavior is material, create comparison samples using the relevant application version and document the settings.
Absence is meaningful only when there is a justified expectation that an artifact should be present. A simple file generated from a library may validly omit optional parts that Word normally creates. A document saved through another editor may normalize structures. Compare like workflows before treating a difference as evidence of manipulation.
Part names shown here are conventional examples. A package can have multiple headers, images, and comment related parts. Their mere presence does not establish that a given section displays them. Follow the relationship and reference from the owning story to determine use. Also distinguish orphaned resources from actively referenced content.
Aptos references can be relevant when a document is claimed to have remained unchanged since a much earlier period. However, a modern template, later save, or theme replacement can introduce those references without changing the substantive text. Font declarations can survive even when a font is not rendered. Test the disputed passage and its effective formatting rather than dating the entire file from one font name.
Custom XML may support a business application, and a glossary document can store reusable content. Neither is inherently suspicious. Embedded images may contain camera or editing metadata, but export and optimization can remove it. Preserve image bytes separately and avoid treating missing metadata as evidence of deliberate cleaning.
These steps preserve the evidence while moving from a defined allegation to a reproducible technical assessment. Collection authority, proportionality, and available records determine the final scope.
We preserve and examine native files, compare relevant versions, and explain findings in language counsel can use. The scope can include source email, computer evidence, cloud records, and a report that distinguishes supported conclusions from unresolved questions. Because our analysts are subject matter experts in Office Open XML, they can tell which XML parts Word writes on its own and which were added or edited by hand.
Elite Digital Forensics is an independent digital forensics practice serving attorneys, paralegals, in house counsel, insurers, lenders, businesses, and individuals nationwide. Our team includes former law enforcement forensic examiners and court qualified expert witnesses in computer, cell phone, cloud, document, and multimedia forensics. Every engagement begins with a scoped plan, hash verified evidence handling, and a clear explanation of what the examination can answer.
Not by itself. Stored identities and software traits can support an attribution hypothesis, but user profiles, templates, copied content, and automation can produce the same observations. Independent account, device, or transmission evidence is usually needed.
A PDF can establish what a particular presentation copy contains, but it does not preserve all Word package evidence. Request the native file and retain the PDF separately. The relationship between the two files must be examined rather than assumed.
A copy may still preserve valuable package and content evidence. Describe its source and limits, seek independently retained versions, and avoid presenting an unknown custody history as a verified original. Byte identity with a source attachment can be particularly useful.
It can. Saving may update properties, rewrite XML, normalize package layout, accept application repairs, or refresh fields. Preserve the original and document any controlled save experiment on a separate working copy with its own hash.
No. An inconsistency requires explanation, but conversion, later authorized edits, templates, clock errors, and differing application behavior can cause similar patterns. A defensible conclusion weighs those explanations against independent records and the specific allegation.
Present the preserved source identity, methods, relevant artifacts, comparisons, and limitations. Separate observed facts from interpretation and identify any missing records that could resolve uncertainty. Counsel determines the applicable legal foundation and procedural requirements.
Provide the preserved file, its known source, and the disputed proposition. We can identify useful tests, collection gaps, and the limits of the available evidence before a broader examination begins. We are court qualified experts in Word document forensics and can present XML level findings as clear exhibits.
Request Confidential Consultation Call (833) 292 3733This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic services and expert witness testimony; we do not provide legal representation. Every case is fact specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder