- Nationwide Digital Forensic & Cyber Investigation Services
Map the PPTX archive from its package entry point to ordered slides, inherited designs and referenced assets without mistaking filenames for presentation sequence.
Home › Digital Evidence Authentication › PowerPoint Presentation Authentication › PPTX File Structure Explained
Quick Answer. A PPTX is an Open Packaging Conventions ZIP package containing XML parts, media and relationship files. The presentation part links to slides, masters and supporting content; relationships determine how those pieces connect. Examiners inventory the archive, validate content types and resolve links before interpreting slides. Filenames, ZIP order and package timestamps alone do not establish creation chronology.
A PPTX is an OPC package whose relationships define how its parts form a presentation. This chapter of PowerPoint Presentation Authentication explains that dependency graph. Continue to slide XML for object semantics or file signatures when the container is uncertain. List stored parts separately from parts reachable through valid relationships.
| Question | Short answer |
|---|---|
| Where does a PPTX package start? | Read [Content_Types].xml and _rels/.rels, then resolve the office document relationship to the presentation part. |
| How does PPTX structure define slide order? | p:sldIdLst lists slide references in presentation order. Resolve each r:id through presentation.xml.rels. |
| Does slide3.xml mean the third PPTX slide? | No. The filename is a package location; the ordered relationship list determines its position. |
| Where do PPTX slides obtain their layouts? | A slide relationship targets a slide layout, which in turn references a slide master. |
| Can a PPTX package retain unused parts? | Yes. An inventory can include media or design parts that no active slide reaches. |
| Why examine PPTX relationship target modes? | TargetMode distinguishes an external destination from a part stored within the package. |
Open Packaging Conventions, the standard for organizing parts, content types and relationships inside an Open XML package.
A named item inside the package, such as a slide XML file, a theme, an image or an embedded workbook.
A typed link from the package or a part to another part or to an external resource.
A declaration identifying how a package part should be interpreted, separate from its filename extension.
A shared design definition used by slide layouts, often carrying recurring backgrounds, placeholders and formatting.
A reusable arrangement of placeholders and design choices associated with a slide master.
Preserve a verified copy before extracting anything. Inventory entry names, sizes, compression methods and duplicate names, then validate the content type declarations and relationships. XML extraction can expose text, but a folder listing is not a presentation model. The examiner must resolve how each part is reached and whether it is actually used.
| Part or folder | Contents | Examination use |
|---|---|---|
| [Content_Types].xml | Default and override content type declarations | Distinguish ordinary presentations, shows, templates and macro enabled types |
| _rels/.rels | Package entry relationships | Locate the main presentation and package level properties |
| ppt/presentation.xml | Slide list, masters and presentation settings | Establish presentation order and overall configuration |
| ppt/_rels/presentation.xml.rels | Targets for presentation relationships | Resolve slide, master, theme and supporting part links |
| ppt/slides | Slide XML and slide relationship files | Connect text and pictures to layouts, notes and media |
| ppt/slideLayouts and ppt/slideMasters | Placeholder arrangements and shared design definitions | Compare design lineage and inherited content |
| ppt/notesSlides and ppt/notesMasters | Speaker notes and shared notes design | Recover notes without confusing page placeholders with speech |
| ppt/handoutMasters and ppt/theme | Handout formatting and theme definitions | Examine print design, colors and font schemes |
| ppt/media, ppt/embeddings and ppt/charts | Media assets, embedded packages and chart definitions | Recover source material and resolve displayed values |
| docProps including docProps/thumbnail.jpeg | Core, extended and custom properties plus optional preview | Compare document claims, application values and saved preview |
Part names shown here are common conventions, not a substitute for relationship resolution. A thumbnail can use a different name or image type. The usual notes master and handout master directories are plural, even though the conceptual part types are called notesMaster and handoutMaster. Examine actual targets rather than requiring one rigid directory inventory.
Suppose p:sldIdLst contains p:sldId id="258" r:id="rId7". Resolve rId7 in ppt/_rels/presentation.xml.rels to slides/slide3.xml. That target can occupy the first visible position even though its basename contains 3. Next read ppt/slides/_rels/slide3.xml.rels and follow the slideLayout relationship to ../slideLayouts/slideLayout2.xml. The layout can reference ../slideMasters/slideMaster1.xml. Record both conventional paths and any cSld name values describing those designs. A design name is a label, not a unique identifier. Inspect p:sldSz in ppt/presentation.xml for the canvas dimensions before evaluating object geometry.
We can build a dependency map showing ordered slides, inherited designs and unresolved targets. This distinguishes an attached asset from one actually used by the disputed slide.
Request Confidential Consultation Call (833) 292 3733A picture shape usually refers to an image relationship in its own slide relationship file. A slide in turn links to its layout; the layout links to a master, and the master links to a theme. This chain explains why a slide may look different when copied into another deck. External relationships need separate treatment because their targets are not necessarily included.
| Observation | Potential significance | Alternative explanation |
|---|---|---|
| Part present but not referenced | Content may be left over or unreachable through normal viewing | A producer may retain unused assets during editing |
| External target path | A chart or object may depend on a resource outside the deck | A legitimate template or linked report may use a shared location |
| Broken relationship | The file may be incomplete, repaired or manually rebuilt | Transfer damage and imperfect conversion can also break links |
| Unexpected content type | Filename and internal role may disagree | Renaming or conversion may explain the difference |
| Duplicate ZIP entry name | Different readers may select different data | Archive construction error must be considered before intent |
Map relationships using their source scope. An identifier such as rId3 has meaning within its relationship file, not across the entire deck. Do not fetch external targets automatically. Preserve the path as evidence and seek the source through an authorized collection process. See embedded objects for the associated source data questions.
Desktop PowerPoint, browser editors, conversion services and programming libraries can all produce packages that open successfully. They may differ in namespace use, XML ordering, default settings, thumbnail creation, extension lists and retained unused parts. A producer pattern is useful only when compared with known examples from relevant software versions and workflows.
A deck exported by another editor may omit optional PowerPoint extensions, simplify charts or rebuild a master. PowerPoint may then repair or normalize it during a later save. These changes can affect hashes and metadata without changing the words shown to recipients. Record any repair prompt on a working copy and preserve the unmodified original for independent parsing.
PPTM permits VBA content, commonly held in ppt/vbaProject.bin, and uses a macro enabled main content type. POTX identifies a template and PPSX identifies a slide show. Related macro enabled template and show variants also exist. Renaming any of these files does not convert their internal content types or remove active content. Verify both the declared type and the actual parts.
ZIP entry dates can be copied, reset or supplied by the producer. Repacking a deck changes archive organization without necessarily changing slide meaning. The XML guide explains semantic comparisons; the signature guide explains cases where a claimed PPTX is actually a compound file, encrypted package or unrelated archive.
Record package membership and relationship reachability as separate columns. This makes missing targets and unused parts visible without altering the archive.
We map presentation dependencies and document whether a disputed object is active, inherited, external or unreferenced. A package inventory also identifies the exact parts requiring XML or asset analysis. The team doing this work is made up of subject matter experts in PPTX file structure who open the package and examine each slide, layout, and master part directly.
Elite Digital Forensics is an independent digital forensics practice serving attorneys, paralegals, in house counsel, insurers, lenders, businesses, and individuals nationwide. Our team includes former law enforcement forensic examiners and court qualified expert witnesses in computer, cell phone, cloud, document, and multimedia forensics. Every engagement begins with a scoped plan, hash verified evidence handling, and a clear explanation of what the examination can answer.
It declares default and part specific content types. Compare those declarations with part content and relationships to identify inconsistent packaging.
Relationships belong to individual source parts. A slide and a chart can each use rId1 for entirely different targets without conflict.
ZIP structures can contain duplicate names. Parsers may select different entries, so record duplicates and avoid extraction that silently replaces one with another.
Common paths include ppt/slideMasters/slideMaster1.xml and ppt/slideLayouts/slideLayout1.xml. Relationships, not these conventional names alone, establish their roles.
No. It establishes a structural condition requiring investigation. Damage, incomplete generation and conversion are alternative explanations to test.
Preserve both hashes and inventories. Report parts removed, rewritten or reassigned by repair, and use the untouched source for claims about original package content.
A dependency map gives every later finding an address and a rendering context. Preserve the original archive, then trace the disputed slide through its relationships rather than assuming proximity in a ZIP listing means connection. Our court qualified experts in PowerPoint forensics can explain how the package structure fits the claimed history of the deck.
Request Confidential Consultation Call (833) 292 3733This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic services and expert witness testimony; we do not provide legal representation. Every case is fact specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder