- Nationwide Digital Forensic & Cyber Investigation Services
Revision save identifiers connect Word paragraphs, runs, and property changes with retained editing contexts. Their distribution can help compare disputed passages and related versions, but their hexadecimal values are not timestamps.
Home › Digital Evidence Authentication › Word Document Authentication › DOCX RSID Analysis and Editing Sessions
Quick Answer. DOCX RSIDs are revision save identifiers stored in word/settings.xml and on WordprocessingML elements. Examiners compare w:rsidRoot, the w:rsids collection, and attributes on paragraphs and runs to map retained editing contexts. Values are random identifiers, not dates or sortable event numbers. Their count is not interchangeable with cp:revision, TotalTime, or a complete editing history.
This guide develops the session evidence within Word Document Authentication. Use DOCX XML parts to locate paragraph and settings markup. Compare RSID findings with document properties without treating their different counters as measurements of the same event.
| Question | Short answer |
|---|---|
| What is a DOCX RSID? | A revision save identifier associates supported WordprocessingML changes with an editing context. Word can generate identifiers during editing and saving, but retained markup is not an exhaustive transaction log. |
| Where is w:rsidRoot stored? | It is a child of w:rsids in word/settings.xml. It records a root identifier useful when comparing related documents, rather than a creation date or personal identity. |
| Does w:rsidR identify inserted text? | It can associate an element with the session in which it was added or revised, according to that element's rules. Read its location and paragraph defaults before assigning a particular run to an identifier. |
| Can DOCX RSIDs be sorted into chronological order? | No. Their random hexadecimal values do not encode time. Chronology needs independently dated versions or other evidence, not numerical sorting. |
| Does the w:rsids count equal the number of Word sessions? | No. It is a retained identifier collection affected by document lineage, copying, settings, and application behavior. Report the collection count separately from identifiers actually used in the examined text. |
| Can w:rsidDel recover deleted wording? | No. It associates deletion context with an element but does not itself contain the removed words. Surviving tracked deletion markup or an earlier version is needed to read that content. |
The settings element containing a document's retained revision save identifiers and any root identifier.
The root revision identifier associated with the document's origin context.
A revision identifier attribute whose exact meaning follows the element on which it appears.
The paragraph attribute giving a default revision identifier for contained runs.
An identifier associated with a run property revision context rather than necessarily changed wording.
An identifier associated with paragraph property changes.
An identifier associated with a deletion context, not a container of deleted text.
An identifier associated with changes to section properties such as page setup.
word/settings.xml can contain a w:rsids element with w:rsid entries and a w:rsidRoot value. These settings describe identifiers retained by the saving workflow. The document body then uses RSID attributes on relevant elements. An examiner inventories both places rather than assuming the settings collection fully describes every identifier found in every story.
| Location | Stored item | Analytical use |
|---|---|---|
| settings.xml | w:rsids | Inventory the retained identifier collection |
| Within w:rsids | w:rsidRoot with w:val | Compare the declared root across versions |
| Within w:rsids | w:rsid with w:val | Compare collection membership without imposing order |
| Paragraphs and runs | RSID attributes | Map actual element contexts to retained values |
| Section properties | w:rsidSect | Separate page setup work from text changes |
A value such as 00A13F72 is an identifier, not a date code. Preserve all eight hexadecimal digits, including initial zeros. Converting it to a decimal number may help a parser normalize comparisons, but it adds no temporal meaning. The order in which entries appear in the settings file is also not a reliable ordering of human drafting events.
Word can generate new identifiers for editing sessions that are saved. What survives depends on revision identifier settings, software behavior, conversion, copying, and later saves. Some files have a rich collection; others have few identifiers or none. A generator that never writes RSIDs is different from a document whose identifiers were deliberately removed. Establish expected behavior through the relevant workflow before interpreting an absence.
Matching roots in documents with matching text and related package features support a common source hypothesis. Matching only a short identifier is weaker: collisions, inherited sources, and copied markup are possible. Different roots do not exclude reuse of a passage. Record the root alongside the compared content and other package features rather than treating it as a unique document fingerprint.
We map revision identifiers around the clause, compare paragraph defaults and formatting changes, and test the distribution against earlier copies. Supply the native versions so the analysis can move beyond a single surviving identifier set.
Request Confidential Consultation Call (833) 292 3733RSID interpretation starts with the element carrying the attribute. Text addition context, run formatting, paragraph formatting, and deletion are different events. Flattening all attributes into one session column can make a formatting change look like a newly written sentence. Keep attribute names and XML locations in the extracted results.
| Attribute | Context to examine | Useful distinction |
|---|---|---|
| w:rsidR | Element addition or revision context | Read the element rules and nearby runs |
| w:rsidRDefault | Default run context within a paragraph | A run can lack its own explicit identifier |
| w:rsidRPr | Run property revision | Formatting need not change words |
| w:rsidP | Paragraph property revision | Alignment or spacing differs from composition |
| w:rsidDel | Deletion context | The identifier does not store missing content |
| w:rsidSect | Section property revision | Margins and page setup can change independently |
A paragraph may give w:rsidRDefault while individual runs carry no explicit w:rsidR. Record the paragraph default and any applicable explicit run values separately. Do not treat a blank run attribute as proof of a separate session. Conversely, a run with an explicit value deserves comparison with the surrounding default, adjacent paragraphs, and retained change markup.
Suppose a payment clause contains an identifier also found in an address update elsewhere, while surrounding boilerplate uses a different default. That distribution is compatible with a shared editing context for those elements. It does not show which was changed first, how long the work took, or whether a single person made both changes. The same visible sentence can also be divided into several runs for formatting, spelling, or field handling.
RSIDs may survive when Track Changes was not enabled. They are not the same as w:ins and w:del, which can retain explicit inserted or deleted content with author and date attributes. Examine tracked changes and hidden content when the question requires actual removed wording or a declared revision author. Neither mechanism independently authenticates a person's identity.
The three measures describe different things. The RSID collection retains identifiers. cp:revision in core.xml reports an application maintained revision value. TotalTime in app.xml reports editing minutes. There is no general equation that converts one to another or requires all three to increase together.
| Measure | What to report | What not to infer |
|---|---|---|
| Settings collection size | Number of distinct retained values and treatment of root | Exact count of every human editing session |
| Used RSID count | Distinct values found in the selected stories and attributes | Number of authors |
| cp:revision | Literal stored revision counter | Number of substantive changes |
| TotalTime | Literal reported minutes | Duration of each RSID context |
State whether the root is included, whether duplicates are removed, and which parts were searched. A count limited to document.xml will not necessarily match one that includes headers, footers, notes, and comments. A settings collection may include identifiers no longer used by surviving text. Conversely, an identifier in markup may not appear in the collection being compared. Preserve those differences rather than silently repairing them.
A file with 18 retained identifiers, cp:revision of 7, and TotalTime of 42 is not mathematically impossible. Reuse can carry an identifier collection forward, another writer can maintain counters differently, and imported content can bring existing markup. These values warrant a workflow comparison, not a finding that exactly 18 sessions occurred in 42 minutes over seven saves.
For a controlled comparison, use the relevant application and record whether revision identifier storage is enabled. Create and save text, change formatting, perform Save As, and compare the resulting parts. Such experiments explain observed software behavior under stated conditions. They do not reconstruct every historical action in the disputed file. See Word metadata for the separate interpretation of revision and duration properties.
Compare the disputed file with independently obtained earlier versions. First align actual text and paragraph structure. Then compare root values, collection membership, paragraph defaults, and explicit run attributes. A shared identifier across matching wording becomes more useful when a dated version establishes that wording already existed by a particular event.
If a February attachment lacks a disputed clause and a March attachment contains it, the attachments bound the observed change between those surviving versions. A new RSID associated with the clause can help map its editing context within the March file. The dates come from the independent version evidence, not from decoding the identifier.
Copy and paste can preserve source formatting and revision identifiers, depending on the application and paste method. A clause carrying an older source identifier might therefore have been pasted much later. Compare suspected source documents directly and test paste behavior if that explanation matters. Shared RSIDs alone cannot decide whether text was drafted in place or imported.
An appropriate finding might describe a clause as associated with a distinct retained revision context from surrounding text. A stronger date conclusion requires dated copies or other records. Do not label a session as a named person's work merely because that person's name appears in core.xml. That property describes a separate document level assertion.
Provide a reproducible extract with part paths, paragraph locators, quoted text, attribute names, and literal values. Distinguish observed associations from proposed history. A reader should be able to locate the same markup without relying on a color coded illustration alone. For broader alteration hypotheses, combine this map with DOCX forgery examination rather than asking RSIDs to answer every authenticity question.
The map must retain element context and count definitions so another examiner can reproduce each association.
We construct paragraph and run level RSID comparisons, identify retained editing contexts, and relate them to independently dated drafts. Reports state the extraction scope and distinguish session associations from dates and personal attribution. RSID work is performed by subject matter experts in Word revision analysis who map editing sessions across related versions of a document.
Elite Digital Forensics is an independent digital forensics practice serving attorneys, paralegals, in house counsel, insurers, lenders, businesses, and individuals nationwide. Our team includes former law enforcement forensic examiners and court qualified expert witnesses in computer, cell phone, cloud, document, and multimedia forensics. Every engagement begins with a scoped plan, hash verified evidence handling, and a clear explanation of what the examination can answer.
Yes. Revision save identifiers and tracked change markup are separate mechanisms. A file can retain RSIDs without retaining insertions, deletions, or a visible review history.
No. Related documents can diverge while retaining a common root. Compare content, package structures, and other evidence; byte identity is tested by hashes, not root identifiers.
Yes, depending on the application and copying method. A shared identifier can reflect imported markup rather than a contemporaneous edit in both destination documents.
A retained collection can outlive the elements that used its values. Search scope also matters. Report the difference without assuming the value represents a recoverable deleted passage.
No. Generators, conversion, and settings can produce files without a retained collection. Establish expected behavior for the claimed writer before drawing an inference about removal.
Not by itself. It can compare that paragraph's editing context with surrounding content. A date conclusion requires independently recorded versions or other evidence tied to the actual signature wording.
Keep earlier attachments and repository versions with the disputed file. Their independent dates allow a revision identifier map to address a real chronology instead of an imagined hexadecimal timeline. Our court qualified experts in DOCX RSID analysis can testify to what the editing sessions do and do not prove.
Request Confidential Consultation Call (833) 292 3733This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic services and expert witness testimony; we do not provide legal representation. Every case is fact specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder