- Nationwide Digital Forensic & Cyber Investigation Services
Hidden is a display state, not deletion. Worksheet XML, formatting, names, comments, pivot snapshots, and external link caches can retain information absent from the visible grid.
Home › Digital Evidence Authentication › Excel Spreadsheet Authentication › XLSX Hidden Sheets, Rows and Data
Quick Answer. XLSX hidden data remains in workbook parts even when Excel does not display it. Inspect sheet states in workbook.xml, row and column settings in worksheet XML, and styles that suppress visible values. Then examine names, comments, pivot caches, and external link caches. These records can preserve omitted information, but they are not a complete archive of deleted workbook content.
This guide examines visibility and retained content within Excel Spreadsheet Authentication. Read the XLSX package structure guide to locate related parts and the formula evidence guide to test calculations that depend on concealed cells.
| Question | Short answer |
|---|---|
| Where is an XLSX sheet's hidden state stored? | A sheet entry in xl/workbook.xml can carry state="hidden" or state="veryHidden". Its relationship identifies the actual worksheet part containing the data. |
| How does veryHidden differ from hidden in Excel? | A hidden sheet can normally be restored through the Unhide dialog. A veryHidden sheet is omitted from that dialog and requires another method to change its state. Neither state encrypts the sheet. |
| Can hidden XLSX rows still affect totals? | Yes. Ordinary SUM formulas generally include hidden rows. Functions such as SUBTOTAL have specific handling for filtered or manually hidden rows depending on the function argument. |
| What does the Excel custom format ;;; conceal? | It suppresses normal display across the positive, negative, zero, and text sections of a custom number format. The stored cell value and formulas remain present. |
| Can an XLSX pivot cache retain missing source data? | Yes. Saved pivot cache records can hold source field values even when the original source worksheet is absent. Their completeness depends on how the workbook was saved. |
| Does Document Inspector recover deleted Excel worksheets? | No. Document Inspector identifies specified categories of hidden or personal content and can remove some of them. It is not a general recovery system for deleted worksheets. |
Attribute on a workbook sheet entry controlling visible, hidden, or veryHidden presentation.
Worksheet row attribute that suppresses a row from the displayed grid.
Column definition property that can make retained content effectively invisible at zero width.
Custom number format with empty display sections while stored content remains unchanged.
Workbook collection of named expressions and references, including hidden names and invalid references.
Conversation comment parts with message references and associated person records.
Saved pivot source records whose fields are interpreted through a cache definition.
Package parts describing linked workbooks and potentially retaining cached external cell data.
Read xl/workbook.xml before relying on the tabs shown in Excel. Each sheet entry supplies a name, sheetId, relationship identifier, and optional state. Follow that relationship through the workbook relationships part to the worksheet. Do not assume that the first visible tab corresponds to sheet1.xml or that sheetId is a filename suffix.
| Workbook sheet state | Normal interface behavior | Stored evidence |
|---|---|---|
| visible or omitted state | Sheet is ordinarily available as a tab | Cells and related resources remain in the package |
| hidden | Sheet is absent from tabs but available through Unhide | Worksheet data remains directly inspectable |
| veryHidden | Sheet is absent from the ordinary Unhide list | Worksheet data is not encrypted by this state |
For each sheet, record its displayed name, state, relationship target, populated cell range, and formula references from other sheets. A veryHidden sheet called Rates can supply inputs to a visible financial summary. Its visibility state explains why a reviewer did not see the source rates; it does not establish that the rates were unauthorized.
Preserve the original XML and use a separate viewing copy if unhiding is needed. Saving a workbook after changing sheet state changes the evidence being examined and can also trigger recalculation. A screenshot of newly revealed content is an illustration, not a substitute for the original package part and its recorded location.
We inventory concealed cell ranges and retained supporting parts before changing any visibility setting. The result is a location based account of what the workbook stores, what the supplied view omits, and how each finding affects the disputed calculation or disclosure.
Request Confidential Consultation Call (833) 292 3733Worksheet visibility controls operate independently of sheet state. A visible sheet can contain hidden rows, hidden columns, columns with zero width, collapsed outline groups, and values made invisible by formatting. Inspect the stored cell inventory first, then explain which display mechanism conceals each range.
| Mechanism | Place to inspect | Comparison to make |
|---|---|---|
| Hidden row | row hidden attribute in worksheet XML | Stored row values versus displayed row sequence |
| Hidden or zero width column | cols and col attributes | Column span, width, hidden state, and populated cells |
| White text | Cell style, font color, fill, and conditional formatting | Effective text color against the displayed background |
| Custom format ;;; | Cell style and numFmt definition | Raw value versus rendered cell text |
| Filter exclusion | autoFilter criteria and row state | All stored records versus selected records |
| Collapsed outline | outlineLevel, collapsed, and hidden attributes | Detail rows or columns versus summary view |
The cell s attribute indexes a cell format in styles.xml. That format links to fonts, fills, and number formats. White font on a white background can obscure text without removing its shared string or inline value. Theme colors, tint values, and conditional formatting can affect the effective color, so a literal search for one white color code is insufficient.
The custom format ;;; leaves the positive, negative, zero, and text display sections empty. A blank looking cell may therefore hold an amount or a formula. Read the raw value, resolve shared strings where applicable, and compare it with the displayed result in a controlled application view. Also inspect ordinary formats that round small numbers to zero.
An autoFilter can suppress records that do not meet criteria without removing those records from worksheet XML. A filter hiding refunds can make sales detail appear larger or more favorable than the complete transaction set. Record the filter range, selected criteria, stored records, and total formulas together. Clearing a filter on a copy demonstrates the alternate view but does not recover deleted data.
Outline groups provide a different mechanism. Rows with outlineLevel values can be collapsed to show a summary while hiding supporting detail. Check both row and column grouping. A narrow or zero width column can retain full account identifiers, notes, or adjustment figures even when no readable content appears in the grid.
Do not infer the total's inclusion rule from appearance. SUM can include concealed amounts, while SUBTOTAL behavior depends on its function number and filtering context. Use the formula and cached value analysis to determine exactly which records contribute to the displayed result.
Named expressions and comment parts can retain information not visible in the current cell grid. Inspect definedNames in workbook.xml and follow worksheet comment relationships. These structures explain references and annotations; they are not a universal record of earlier workbook contents.
A definedName can refer to a range, constant, formula, print area, or external reference. Its localSheetId can establish sheet scope, and its hidden attribute can suppress ordinary listing. Preserve the name, scope, expression, and visibility flag. A name pointing to a range that is now empty identifies a reference, not the former values in that range.
A reference containing #REF! can indicate a broken or removed target. A retained name mentioning an absent sheet can support an investigation into workbook restructuring, especially when an earlier copy resolves it. It cannot alone establish what was stored on that sheet or when removal occurred. Compare names with active sheets and with formulas that still use them.
Traditional comments are commonly stored in parts such as xl/comments1.xml with cell references, authors, and text. Their associated drawing information controls display. Threaded comments use separate conversation parts, often under xl/threadedComments/, with person records in related package content. Inventory both forms because conversion between application versions can change their representation.
Retain comment text, target cell, author or person identifier, message relationships, and available time fields. A person name in a comment is application supplied attribution, not independent proof that a particular individual typed the message. Correlate it with collaboration records when authorship matters. Treat time fields according to their recorded format and the source application's behavior.
Pivot caches and external link caches can store copies of values outside the visible worksheets. They are snapshots supporting workbook behavior, not a continuous history. Extract them before refreshing connections or saving the workbook, because those actions can replace the retained data being investigated.
A pivot table can reference a cache definition under xl/pivotCache/. The definition describes fields and may point to a pivotCacheRecords part. Record entries can contain values directly or indexes into shared field items. A list of integer indexes without the matching cache definition is not a reliable list of source values.
Map the pivot table to its cache, then the cache fields to each decoded record. Preserve original record order without assuming it is transaction chronology. Some workbooks save no cache records, and some caches retain values no longer apparent in the current source range. Confirm the source reference and saved record count before describing the cache as a copy of the entire source dataset.
Parts under xl/externalLinks/ can describe an external workbook, its sheet names, defined names, and cached sheet data. Follow relationships to record the linked target. A path is evidence of a recorded connection, not proof that the target file is currently available or that it was authored on the computer being examined.
Extract cached cell references, types, and values before permitting any link update. The cache can preserve a previously supplied exchange rate or budget figure after the external source becomes unavailable. Its presence does not establish the full contents of that source workbook, and it does not supply a dependable refresh date unless supported by other records.
Document Inspector can identify categories of hidden content and personal information and offer removal actions. It is designed for document cleanup, not forensic preservation. Record its findings on a disposable copy and do not select removal actions on the collected file. Removal can affect formulas, comments, and the ability to explain how the workbook originally behaved.
Start with package records, then reproduce the visible view. Keep each visibility change separate from the original evidence.
We create sheet state inventories, concealed range schedules, comment extracts, and decoded cache tables. Each item identifies its package location and explains whether it is active data, a display setting, a broken reference, or a retained snapshot. Our examiners are subject matter experts in hidden spreadsheet content and recover very hidden sheets, hidden rows, defined names, and filtered data.
Elite Digital Forensics is an independent digital forensics practice serving attorneys, paralegals, in house counsel, insurers, lenders, businesses, and individuals nationwide. Our team includes former law enforcement forensic examiners and court qualified expert witnesses in computer, cell phone, cloud, document, and multimedia forensics. Every engagement begins with a scoped plan, hash verified evidence handling, and a clear explanation of what the examination can answer.
Yes. Their worksheet XML can be examined directly through the workbook relationships. Macros are not required to read the stored cell content.
Changing visibility modifies the open workbook state, and saving commits changes. Perform the demonstration on a separate copy while retaining the original package and visibility records.
A name can retain a reference or broken expression after the range changes. That reference does not normally preserve all former cell values; inspect earlier versions and cache parts separately.
Yes. Stored values and style records can identify potential suppression. Effective appearance still depends on background, theme, and conditional formatting, which should be checked in a controlled view.
Yes. Cached sheet data can retain values from linked sources. It represents the saved cache, not verified current source content or a complete external workbook.
No removal action should be applied to the collected evidence. Use a disposable copy to document Inspector findings and preserve hidden parts before any cleanup experiment.
Provide the native workbook and describe which sheets or figures were presented to the reviewer. We can compare that view with stored ranges, annotations, and cache snapshots while preserving the original visibility settings. When hidden data matters, our court qualified experts in Excel forensics can present what was concealed and when.
Request Confidential Consultation Call (833) 292 3733This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic services and expert witness testimony; we do not provide legal representation. Every case is fact specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder