- Nationwide Digital Forensic & Cyber Investigation Services
Inserted and deleted wording, moved passages, comments, and hidden formatting can remain inside a Word package even when the displayed page looks clean. Examine the markup before accepting changes or running Document Inspector.
Home › Digital Evidence Authentication › Word Document Authentication › DOCX Track Changes, Comments and Hidden Content
Quick Answer. DOCX files can retain tracked insertions in w:ins, deletions in w:del and w:delText, moves, and formatting revisions with declared author and date attributes. Comments and people records may identify review participants. Hidden text and white text are separate display mechanisms. Examiners inspect the native XML and compare controlled views without modifying the preserved document.
This review evidence guide belongs to Word Document Authentication. Read DOCX XML parts for story and relationship locations, and RSID analysis for editing associations that are distinct from explicit tracked revisions. A clean reading view does not establish that the package contains no removed or concealed wording.
| Question | Short answer |
|---|---|
| Where does DOCX store tracked inserted text? | Tracked additions commonly appear in w:ins containers within document stories. The container can carry w:author and w:date while its runs retain the inserted content. |
| Can w:delText reveal deleted Word wording? | Yes, when tracked deletion markup survives. w:del can contain runs with w:delText holding the deleted characters. Ordinary deletion without retained markup does not create a recoverable archive of every removed word. |
| What do w:moveFrom and w:moveTo mean? | They represent tracked source and destination content for moves. Interpret them with associated move range markers and identifiers so the same moved passage is not reported as unrelated deletion and insertion. |
| Where are DOCX comments stored? | Traditional comment bodies are stored in word/comments.xml and connected to anchors by comment identifiers. Additional parts can hold extended discussion or participant data, depending on the document version. |
| Does w:vanish delete hidden text? | No. It is a run property that suppresses ordinary display according to Word settings. The underlying characters can remain in the package, including when hidden formatting is inherited from a style. |
| Does Document Inspector preserve DOCX review evidence? | Removal actions can alter or remove review material and personal information. Preserve the original first, and inspect only a separate copy when documenting what the feature detects or changes. |
A tracked insertion container carrying added content and revision metadata.
The element used for text within tracked deletion content.
A tracked move source container, interpreted with related range markup.
A tracked move destination container that preserves the relocated content.
A run property revision record containing earlier run properties and change attributes.
The traditional comment body part whose comment identifiers link to anchors in document stories.
An optional Word extension part containing person information associated with review participants.
The run property controlling hidden formatting, which is separate from text color.
Tracked revisions can retain both an edited reading and the wording it replaced. A w:ins container marks inserted content; a w:del container marks deleted content, commonly with characters in w:delText. The displayed result depends on the selected review view. Choosing No Markup changes presentation, not necessarily the underlying package.
| Markup | Content or attribute | Examination question |
|---|---|---|
| w:ins | Added runs and text | Which words remain marked as inserted? |
| w:del | Deleted runs | Which removed structures still survive? |
| w:delText | Deleted characters | What exact removed wording is readable? |
| w:author | Declared revision identity | Which stored label is associated with the change? |
| w:date | Declared revision time | What time does the markup assert? |
| w:id | Revision identifier | How is the revision identified within its markup context? |
A changed clause can span multiple runs, fields, table cells, or paragraph boundaries. Capture its XML location and surrounding wording. A simple search for w:t can omit deleted text because w:delText uses a different element. Conversely, concatenating every text element can place mutually exclusive old and new readings together as if both formed one sentence.
Produce separate interpretations of the current reading and retained deleted content. If the clause replaces a payment period of 30 days with 60 days, identify which value belongs to deletion and which belongs to insertion. Keep paragraph marks and table boundaries where their change affects meaning. Screenshots of the review display can illustrate the finding, but the native markup supports the extraction.
w:author can be a configured profile name, a shared label, or an edited string. w:date records the revision's declared time rather than a trusted server event. Preserve the literal date and its zone notation, then compare it with independently obtained versions. Do not assign every action to the person named in the revision without additional evidence connecting that person to the editing event.
Accepting or rejecting changes can remove the alternative wording from the current package. A later file with no tracked deletions therefore does not establish that no earlier deletions occurred. Earlier attachments, repository versions, or backups may hold the needed revision state. The current file alone cannot supply text that no longer survives.
Preserve the native package before accepting changes, deleting comments, or removing personal information. We compare revision markup, anchored comments, and display formatting to show what survives beyond the ordinary reading view.
Request Confidential Consultation Call (833) 292 3733Word can represent a moved passage through w:moveFrom and w:moveTo rather than only an unrelated deletion and insertion. Move range markers help identify the relevant source and destination ranges. Examiners read those relationships and surrounding content before concluding that a paragraph was newly drafted.
| Revision feature | Stored evidence | Interpretive distinction |
|---|---|---|
| w:moveFrom | Content at the move source | The source can be excluded from the final reading |
| w:moveTo | Content at the move destination | Relocation is not necessarily new wording |
| Move range markers | Range identifiers and names | Map source and destination in context |
| w:rPrChange | Previous run properties | Formatting changes differ from text replacements |
| w:pPrChange | Previous paragraph properties | Spacing or alignment can change without rewriting |
A clause moved from an appendix into the main agreement may gain prominence without changing its words. Record its source location, destination location, retained text, and associated revision attributes. If the content changed as well as moved, describe both operations rather than forcing the whole event into a single category. A display that hides the source can otherwise make relocation appear to be composition.
Current run properties and the earlier properties stored inside w:rPrChange can show that bold, font, color, or other formatting changed. The revision record can carry w:author and w:date. It is not itself an archive of the previous sentence. Compare the property sets directly and specify the changed attribute or element instead of describing every formatting revision as a substantive textual edit.
Other revisions can affect paragraph properties, numbering, tables, or section layout. The examination scope should include the features material to the dispute, especially where a layout change alters the apparent relationship between a heading and a clause. RSID attributes can provide additional editing associations, but they do not replace explicit revision content or authenticate its dates.
word/comments.xml commonly holds traditional comment bodies with identifiers, author labels, dates, and initials. Markers such as w:commentRangeStart, w:commentRangeEnd, and w:commentReference connect those identifiers with locations in document stories. Extract the comment and its anchor together; an isolated comment can be misleading without the passage it addresses.
A review comment reading “confirm this amount” has different significance when anchored to the fee clause rather than the address block. Record the linked text, comment identifier, body, author, date, and story location. Some anchors can be point references rather than substantial text ranges. Preserve unresolved references and orphaned comments as findings rather than silently dropping them.
Later Word features can add extended comment parts, reply relationships, status information, and participant records. word/people.xml is an optional extension part that can contain person information associated with review participants, including author labels and presence related information where stored. Its presence and schema depend on the application and feature set. Follow actual relationships and namespaces rather than assuming every commented document has the same parts.
A reviewer can comment without composing the text. A person record can support identification of a participant label but does not prove that person approved the final contract. Compare review content with source email, authorized repository activity, and the actual version sent for approval. Document level creator labels in core properties describe another evidence layer and should not be substituted for revision or comment attribution.
Hidden text and white text can both escape ordinary reading, but they use different mechanisms. w:vanish is a hidden run property. White text uses a color setting that can blend into a white background. Neither necessarily removes the underlying characters. Effective formatting can come from direct run properties or styles, so checking only direct properties misses some hidden content.
Inspect w:rPr and applicable character and paragraph styles. A run can inherit hidden formatting, and explicit property values can override inherited behavior. Also inspect text color, theme color resolution, background shading, and relevant display settings. White characters may be visible on a dark background; hidden formatting may be revealed when hidden text display is enabled. A formatting choice is an observation, not proof of intent.
Search other stories such as headers, footers, footnotes, endnotes, and text boxes when they fall within scope. Ordinary text extraction and a normal page view can differ because each treats revision markup, fields, and hidden formatting differently. Explain the extraction method and do not present every XML string as visible body text.
Document Inspector can detect categories of hidden data, review material, and personal information and offer removal actions. It is a privacy feature, not a complete forensic inventory. Microsoft notes limits, including forms of content it may not detect; white text is not equivalent to the hidden text category. A clean inspection result does not establish that the package contains no unseen or misleading material.
Record the application version, categories selected, reported findings, and any removal actions on a separate working copy. Compare the package before and after the experiment if removal behavior matters. Never run cleanup on the only evidential copy. Accepting revisions, deleting comments, and changing visibility can each alter evidence needed to reconstruct what a reviewer previously saw.
The final report should separate retained historical content, current but suppressed content, and material absent from the available file. This distinction prevents a surviving deletion from being described as current contractual wording and prevents hidden current text from being dismissed as merely historical.
Inspect the package first, then render controlled views that preserve the distinction between current wording and retained alternatives.
We extract retained revisions, map anchored comments, and compare hidden formatting with controlled reading views. Findings identify which wording is current, which alternatives survive, and which reviewer identities or dates remain only declared attributes. Our team includes subject matter experts in hidden Word content who recover tracked changes, comments, and text the screen view never shows.
Elite Digital Forensics is an independent digital forensics practice serving attorneys, paralegals, in house counsel, insurers, lenders, businesses, and individuals nationwide. Our team includes former law enforcement forensic examiners and court qualified expert witnesses in computer, cell phone, cloud, document, and multimedia forensics. Every engagement begins with a scoped plan, hash verified evidence handling, and a clear explanation of what the examination can answer.
No. Turning tracking off stops recording subsequent changes under that setting; existing revisions can remain until separately accepted, rejected, or otherwise removed.
No. Acceptance can remove the deleted content from the saved package. Earlier versions or backups may be needed; ZIP packaging is not a complete historical archive.
Yes. It can retain earlier run properties while the characters remain the same. Compare the old and current properties to identify the actual formatting difference.
No. It is optional participant information associated with supported review features, not an access log or a list of every reader.
Not necessarily. Display and print options affect hidden text handling. Document the specific settings and inspect the stored content separately from any printed rendering.
No. Preserve them with the native file and its original delivery records. Removing comments can destroy anchors, reviewer statements, and attributes relevant to the dispute.
Send the native file rather than only a clean export. Retained revisions, anchored comments, and suppressed text can answer questions the ordinary page display cannot resolve. When hidden content matters to a case, our court qualified experts in Word document forensics can present it to the court.
Request Confidential Consultation Call (833) 292 3733This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic services and expert witness testimony; we do not provide legal representation. Every case is fact specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder