- Nationwide Digital Forensic & Cyber Investigation Services
A displayed total is not the calculation that produced it. Examine worksheet expressions, saved results, calculation settings, and numeric storage before accepting a spreadsheet figure.
Home › Digital Evidence Authentication › Excel Spreadsheet Authentication › XLSX Formulas, Cached Values and Calculation Chains
Quick Answer. XLSX stores a cell formula in an f element and its saved result in a v element. Those records can disagree with a fresh calculation. Examiners preserve both, expand shared formulas, identify constants replacing expected expressions, and recalculate a separate copy with documented inputs. Calculation chains describe calculation order, not the sequence of human edits.
This calculation guide belongs to our Excel Spreadsheet Authentication series. The worksheet XML guide explains where cell records live, while hidden spreadsheet data explains concealed inputs that can change an apparently simple total.
| Question | Short answer |
|---|---|
| Where does an XLSX store a formula and its cached result? | The worksheet cell contains an f element for the expression and usually a v element for the saved result. Cell type and style determine how that result is interpreted. |
| Does an XLSX cell without f prove a formula was overwritten? | No. It establishes that the examined cell stores no formula expression. A prior version or a documented formula pattern is needed to support replacement of a formula. |
| Why can an XLSX cached value disagree with recalculation? | Manual calculation, changed inputs, unavailable external data, volatile functions, and different calculation engines can produce disagreement. A deliberately edited cache is another possibility to test. |
| Does calcChain.xml record the order of spreadsheet edits? | No. It records calculation order information for formula cells. Its sequence and omissions are not a chronology of user actions. |
| What does fullCalcOnLoad mean in an XLSX workbook? | It requests a full calculation when the workbook loads. It does not certify that the saved results were current when the file was collected. |
| Why do shared XLSX formula cells sometimes have empty f elements? | A shared formula follower can identify the shared group by si without repeating the expression. The expression must be reconstructed from the group's base cell using relative reference rules. |
Worksheet cell child containing an expression, normally without the initial equals sign displayed in Excel.
Worksheet cell child holding a stored value, including a saved formula result when present.
Workbook calculation properties, including calculation mode and requests for recalculation.
Optional calculation chain part listing formula cell calculation order information.
Index connecting a shared formula base with cells whose expressions derive from it.
Workbook property selecting the 1904 date system when enabled.
The significant digit limit that separates an Excel number from a losslessly stored text identifier.
The formula and the cached value are separate evidence. In xl/worksheets/sheet1.xml, a cell such as C10 can contain <f>SUM(C2:C9)</f> and <v>800</v>. The first records the instruction; the second records the saved output. Neither should be silently replaced during initial examination.
| Cell record | Immediate finding | Next comparison |
|---|---|---|
| f expression and numeric v | Formula and saved numeric output coexist | Calculate the expression from preserved inputs |
| Numeric v with no f | The cell stores a constant | Compare neighboring formulas and earlier versions |
| f present with no usable v | No usable saved result is available | Document absence before controlled calculation |
| f with an error result | The saved calculation produced an error | Read the cell type and inspect dependencies |
If C2 through C19 contain multiplication formulas and C20 stores 950 as a number, C20 breaks the formula pattern. It might be an authorized adjustment, an imported amount, or a formula overwritten by a number. An earlier native workbook showing an expression at C20 establishes the structural change. Source invoices and adjustment records establish whether the change was justified.
A hardcoded total can remain unchanged while its detail changes. Sum the actual inclusion range independently, including hidden rows, and compare that sum with the stored total. Record excluded cells and intentional rounding. A number matching the expected answer does not transform a constant into a formula, and a formula does not establish that its input transactions are genuine.
The cell's t attribute affects interpretation of v. An error, Boolean value, string result, and number are not interchangeable. The s attribute selects a style that can make a number appear as a date, currency amount, or percentage. A displayed 10 percent commonly corresponds to the stored numeric value 0.1. Keep the expression, raw result, style index, and rendered display together in the evidence schedule.
We trace the disputed cell to its expression, saved result, dependencies, and source records. The examination distinguishes the number present at collection from the result produced in a documented recalculation experiment.
Request Confidential Consultation Call (833) 292 3733xl/calcChain.xml describes calculation order, not editing order. Its cell entries identify references and sheet context. An entry earlier in the part is not evidence that a person typed that formula earlier. The chain can be rebuilt or omitted by spreadsheet software, so a missing chain is not proof of deletion or tampering.
| Calculation feature | Technical reading | Forensic limit |
|---|---|---|
| Chain cell r attribute | Cell reference within calculation order information | Not an edit timestamp |
| Gaps in chain coverage | Some formula cells are not represented as expected | Requires producer and validity checks |
| calcMode manual | Automatic recalculation is restricted | Does not identify who selected the mode |
| fullCalcOnLoad enabled | A full calculation is requested at load | Does not validate existing cached results |
| Shared f with si | Formula belongs to a shared expression group | Empty follower text is not a missing formula |
A shared base might contain an f element with t="shared", si="2", and ref="D2:D20". Its expression B2*C2 supplies the pattern. A follower at D3 can contain an f element with the same si and no expression text. Its effective expression is B3*C3, subject to absolute and mixed reference rules. A reference such as $B$2 must remain fixed during reconstruction.
Count formula cells after expanding shared groups, not by counting nonempty f text. Preserve the original XML alongside the reconstructed expressions so another examiner can test the translation. Shared index values are local technical identifiers, not author identifiers or a dependable measure of editing sessions.
Compare each chain reference with its worksheet cell and record unresolved references. A chain pointing to an absent formula deserves investigation, but software conversion and stale chain maintenance are plausible mechanisms. Establish whether the package was produced by Excel, a reporting library, or a conversion process using the application properties and surrounding evidence.
Record calcPr attributes such as calcMode, calcId, fullCalcOnLoad, and forceFullCalc when present. calcId relates to the calculation engine version; it is not a user identity. If calculation is requested at load, opening the workbook can destroy the opportunity to observe its original caches in an ordinary application view. Extract those caches first.
Preserve the saved state, then calculate an experimental copy under recorded conditions. A cached value of 800 and a new result of 920 establish a reproducible difference only if the tested expression, inputs, application, and settings are identified. They do not by themselves explain when or why the stored answer became different.
Disable automatic external link updates during the initial viewing pass. Inventory linked workbooks, data connections, named references, and functions that depend on the current time or random values. TODAY, NOW, and RAND make uncontrolled comparisons unreliable. Functions implemented differently by different spreadsheet engines require application specific testing.
Use one copy to record the preserved display and another for recalculation. Capture saved cached values in a cell address table before either copy is saved. Record the calculation mode, iterative calculation settings, external source availability, and whether precision as displayed is enabled. Do not manufacture replacement inputs merely to make a reported total reconcile.
A formula can legitimately return a different answer when a linked exchange rate changes. Conversely, a manually edited v value can leave the f expression intact. The comparison must separate changed inputs, changed expressions, changed settings, and changed stored outputs. Report each category rather than reducing every difference to an allegation of altered formulas.
For a disputed invoice ledger, produce a table of affected cell addresses, original formulas, original caches, independently calculated results, and absolute differences. Explain rounding at the transaction level versus rounding only the final sum. A one cent discrepancy can follow either method without implying an unauthorized edit. Keep the numerical explanation tied to the workbook's actual business rules.
Excel dates are commonly stored as serial numbers interpreted through number formats and the workbook date system. In the 1900 system, serial 60 represents the fictitious 29 February 1900. That compatibility behavior is not evidence that the underlying transaction occurred on a real calendar date. Serial 61 corresponds to 1 March 1900.
The workbookPr date1904 attribute selects the 1904 system when true. In that system serial zero corresponds to 1 January 1904. For corresponding ordinary dates, the two systems differ by 1,462 days. A date copied between systems without proper adjustment can appear about four years wrong even though the underlying stored number was transferred intact.
Fractional serial values encode time of day. They do not by themselves specify a time zone. Preserve the raw serial, the number format, the date system, and the conversion method used in the report. Text that resembles a date needs separate treatment because locale dependent parsing can reverse month and day. A worksheet date is also distinct from a file creation timestamp.
Excel retains only 15 significant decimal digits of precision for numeric input. Entering a longer account number as a number can replace later digits with zeros. Once those digits are absent from the saved numeric value, formatting the cell as text does not restore them. Compare the original export, source system, or an earlier text based record.
Displayed rounding can conceal differences between stored values. Binary floating point arithmetic also means some decimal fractions are not represented exactly. Inspect raw values and explicit rounding functions before treating a tiny difference as an edit. For identifier fields, verify whether each cell stores text or a number; identical screen appearance can conceal materially different storage.
The appropriate conclusion separates storage artifacts from human action. A shifted date can result from a system mismatch; a truncated identifier can result from numeric entry; an unexplained constant can result from replacement. Attribution requires comparative records, not a guess based on the visual appearance of a cell.
Build a cell level comparison that another examiner can reproduce without changing the collected workbook's saved answers.
Our examiners produce formula maps, original cache schedules, and documented recalculation comparisons. We explain which discrepancies concern stored expressions, which concern saved outputs, and which arise from date or numeric interpretation. This review is performed by subject matter experts in Excel formula analysis who compare stored formulas, cached values, and the calculation chain for mismatches.
Elite Digital Forensics is an independent digital forensics practice serving attorneys, paralegals, in house counsel, insurers, lenders, businesses, and individuals nationwide. Our team includes former law enforcement forensic examiners and court qualified expert witnesses in computer, cell phone, cloud, document, and multimedia forensics. Every engagement begins with a scoped plan, hash verified evidence handling, and a clear explanation of what the examination can answer.
Yes. The expression and cached result are distinct XML content. A cache difference therefore requires testing against inputs and earlier copies; it is not automatically an expression change.
No. It shows the total is stored as a constant. Supporting records determine whether that constant represents an authorized adjustment, an export convention, or an unsupported substitution.
Yes. Recalculation at load can replace the displayed saved answer with a new result. Preserve the original caches before opening and compare the two states separately.
No. It is the fictitious date assigned to serial 60 in the 1900 date system for compatibility. It must not be interpreted as a valid calendar event.
No. Calculation chain entries do not record user attribution. Authorship needs other evidence such as version history or documented source files.
Excel numeric input is limited to 15 significant decimal digits. Longer identifiers should be preserved as text and checked against their source records.
Provide the native workbook, the disputed cell addresses, and any earlier versions or source exports. We can define a calculation test that preserves the original stored results and explains each material difference. Our court qualified experts in spreadsheet forensics can show the court where a cached value no longer matches the formula that produced it.
Request Confidential Consultation Call (833) 292 3733This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic services and expert witness testimony; we do not provide legal representation. Every case is fact specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder