- Nationwide Digital Forensic & Cyber Investigation Services
Read slide objects as XML: distinguish text runs, picture references, inherited placeholders and persistent identifiers before comparing what changed.
Home › Digital Evidence Authentication › PowerPoint Presentation Authentication › PPTX XML Parts and What They Contain
Quick Answer. PPTX XML parts describe the presentation sequence, slide objects, design inheritance, notes, comments and chart connections. Examiners follow relationships rather than reading numbered slide files in isolation. Text runs, object geometry and extension values can reveal content and slide lineage, but XML identifiers and retained settings do not provide a complete editing history or independently establish authorship.
This guide is part of PowerPoint Presentation Authentication. Read it alongside presentation structure and content analysis and timeline and authenticity testing. The focus here is pptx xml parts, with a clear separation between observed file facts and conclusions that require independent corroboration.
| Question | Short answer |
|---|---|
| What does p:spTree contain in PPTX XML? | It holds slide drawing objects, including shapes, pictures, groups and graphic frames. |
| Where is readable slide text stored in PPTX XML? | Text commonly appears in a:t nodes within paragraphs and runs. Preserve paragraph boundaries when reconstructing sentences. |
| How does a PPTX p:pic identify its image? | Its a:blip r:embed value resolves through the slide relationship file to the stored media part. |
| Does p14:creationId date a PPTX slide? | No. It is an identifier useful in comparisons, not an encoded creation timestamp. |
| Why can PPTX slide XML omit a visible font? | The effective font can come from a layout, master or theme rather than a local text property. |
| Which PPTX XML controls the presentation canvas? | p:sldSz in ppt/presentation.xml provides cx and cy dimensions used when interpreting object geometry. |
The ordered slide identifier list in the presentation part. Its references resolve through presentation relationships.
The slide shape tree holding drawing objects, including shapes, pictures, groups and graphic frames.
A span of text with associated formatting. A sentence may be split across multiple runs and paragraphs.
An extension value that may persist with a slide through copying. It supports lineage comparisons but is not a timestamp.
The way a slide obtains placeholder geometry, styles and theme choices from its layout and master.
Values stored with a chart for rendering, which may not match every value or formula in its source workbook.
XML prefixes are conventional labels for namespaces, not immutable evidence. A producer may choose different prefixes while expressing the same elements. Examiners compare namespace identities, values and resolved relationships. Plain text searches are useful for triage but can miss inherited text, grouped objects, drawing content and media.
| Part or element | Contents | Forensic value |
|---|---|---|
| ppt/presentation.xml: p:sldIdLst | Ordered slide references | Reconstruct ordinary slide order rather than filename order |
| p:sldMasterIdLst and p:sldSz | Master references and slide canvas dimensions | Resolve design inheritance and evaluate off canvas geometry |
| p:custShowLst | Named custom shows and selected slide sequences | Identify alternate subsets and orders available to a presenter |
| slideN.xml: p:cSld and p:spTree | Common slide data and drawing object tree | Locate shapes, groups and pictures in their drawing context |
| p:sp and a:t | Shape content and text runs | Recover wording and formatting boundaries without inventing an edit chronology |
| p:pic, a:blip r:embed and a:srcRect | Picture reference and crop parameters | Resolve the full image and compare the visible crop |
| p14:creationId extensions | Slide creation identifier values where retained | Compare slide lineage across independent decks |
| slideLayouts and slideMasters | Named layouts, placeholders and inherited design | Identify template patterns and shared design sources |
| notesSlides | Notes shapes, placeholders and notes text | Recover narrative context distinct from slide number fields |
| comments and commentAuthors or modern comment parts | Comment text, author associations and supporting data | Identify review content subject to format and producer differences |
| presProps.xml and viewProps.xml | Presentation behavior and stored view settings | Explain playback and editor settings without treating them as event logs |
| tableStyles.xml and theme parts | Table style definitions and design defaults | Compare formatting systems across related decks |
| chart parts: c:externalData | Relationship to source data, commonly an embedded workbook | Locate underlying values and test displayed chart claims |
The modern comments model differs from older comment and author lists. Inventory the actual parts and content types before selecting a parser. Preserve unrecognized extensions rather than discarding them. Layout and master names may describe a template, but those labels can be reused or changed and do not independently establish a source organization.
In ppt/slides/slide3.xml, a p:pic can contain a:blip r:embed="rId4" and a:srcRect l="10000" r="20000". These crop values represent 10 percent and 20 percent of source width at the respective sides, not pixel counts. Resolve rId4 before examining the underlying image. A text shape beside it can hold several a:t nodes with different formatting. The root p:sld show="0" affects ordinary show visibility without deleting either object.
We can trace a disputed text run, picture or chart through its XML and relationship context, retaining the exact part and object identifiers behind the comparison.
Request Confidential Consultation Call (833) 292 3733A semantic examination connects stored values to a specific claim. The existence of one text run does not mean it was typed in one session. The existence of several runs does not mean several people edited a sentence. Shape identifiers, relationship identifiers and XML ordering serve application needs and should not be treated as a hidden audit log.
| XML observation | Possible use | Important limit |
|---|---|---|
| Matching p14:creationId values in two decks | Support a shared slide lineage hypothesis | Do not identify the person, direction or date of copying |
| Different object geometry with matching text | Identify design changes between versions | Layout substitution can cause automatic repositioning |
| a:srcRect crop changes | Establish a difference in the displayed region | The underlying image may still be byte identical |
| Slide title absent from a:t search | Prompt review of inherited shapes or picture text | Absence from a simple search is not absence from the rendered slide |
| Embedded workbook differs from chart cache | Identify a data consistency question | A stale cache or deferred refresh can be innocent |
Crop values generally express relative amounts in the DrawingML percentage representation, where 100000 corresponds to 100 percent. Interpret each edge and transformation together rather than assuming the numbers are pixels. A changed crop may conceal a label visually without deleting the original image. See hidden content for that distinction.
For each slide, record its presentation position, part URI, relationship targets, text, hidden state, notes connection and referenced assets. Record layout and master dependencies separately. A useful comparison preserves both raw XML and normalized findings so another examiner can distinguish substantive changes from namespace, attribute ordering or compression changes.
PowerPoint slide extensions can include p14:creationId values that survive copying between decks. A match combined with identical text, shapes and media can support common ancestry. It does not prove theft, access by a particular person or the direction of transfer. A widely distributed template, a duplicated source deck or a third common ancestor may explain the same match.
Notes parts include placeholders and supporting material in addition to actual speaker notes. Separate these categories in the report. Older comments associate author records with comments, while modern comments use a different structure. Presentation properties and view properties reflect stored application settings, not a reliable record of presentation events or a complete sequence of edits.
A c:externalData relationship can point to an embedded workbook. Examine that workbook with the methods in Excel spreadsheet authentication. Compare formulas, cached results, hidden sheets and source ranges against the chart cache and rendered labels. A correct picture of a chart can still omit source rows or reflect an earlier calculation state.
Keep object identity, textual content and inherited rendering properties separate. A flattened text dump cannot explain every visual difference.
We produce source addressed slide object comparisons that distinguish changed text, changed assets and inherited design effects. XML exhibits retain the relationships needed to reproduce each finding. Because our analysts are subject matter experts in PresentationML, they can tell which slide XML PowerPoint generated and which was edited or inserted later.
Elite Digital Forensics is an independent digital forensics practice serving attorneys, paralegals, in house counsel, insurers, lenders, businesses, and individuals nationwide. Our team includes former law enforcement forensic examiners and court qualified expert witnesses in computer, cell phone, cloud, document, and multimedia forensics. Every engagement begins with a scoped plan, hash verified evidence handling, and a clear explanation of what the examination can answer.
Match namespace URIs and local element names rather than assuming every producer uses p and a. Prefix spelling can differ without changing element meaning.
Yes. Drawing order and fills can obscure a shape while its text remains stored. XML presence and visible rendering should be recorded separately.
Follow the slide relationships to notes and comment parts. Keep their text separate from slide body text and preserve author associations where available.
It records view related application state, such as saved view settings. It is not a complete history of what a presenter displayed.
Chart parts can contain series formulas, labels and cached values. These require chart specific parsing and comparison with the referenced workbook.
Yes. Compare theme major and minor font definitions and local overrides. A theme change may affect many slides without changing their a:t text.
Retain the slide path, shape identifier and relationship target behind each observed difference. That source map makes a text or picture comparison more useful than an unexplained XML diff. We are court qualified experts in presentation forensics and can present XML level findings as clear exhibits.
Request Confidential Consultation Call (833) 292 3733This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic services and expert witness testimony; we do not provide legal representation. Every case is fact specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder