- Nationwide Digital Forensic & Cyber Investigation Services
An XLSX is a graph of related parts inside a ZIP container. Follow its relationships to identify sheets, dependencies and resources omitted from the visible grid.
Home › Digital Evidence Authentication › Excel Spreadsheet Authentication › XLSX File Structure Explained
Quick Answer. An XLSX file is a ZIP package containing XML parts and other resources linked by relationships. The package relationship identifies the workbook, whose relationships identify worksheets and supporting parts. Examiners inventory archive entries, resolve relationship targets and check content types before interpreting cells. A filename such as sheet1.xml does not itself identify a worksheet tab or prove completeness.
This package guide belongs to Excel Spreadsheet Authentication. It explains how to locate content reliably before interpreting SpreadsheetML elements or assessing file signatures. Treat the archive as a linked structure, not a folder full of independently meaningful filenames. The sheet visible as Accounts may be stored in a part whose number bears no relationship to its current tab position.
| Question | Short answer |
|---|---|
| Is an XLSX file just a ZIP archive? | It uses ZIP storage, but spreadsheet meaning comes from content types, XML vocabularies and relationships. An arbitrary ZIP renamed XLSX is not a valid workbook. |
| Where does XLSX file structure identify the workbook? | The package relationship part _rels/.rels normally points to xl/workbook.xml through an office document relationship. Resolve that target rather than assuming the conventional path. |
| Does sheet1.xml mean the first XLSX tab? | No. Workbook sheet elements define the tab list and refer through relationship IDs to worksheet parts. Part numbering is a storage convention, not a reliable visible order. |
| What does [Content_Types].xml do in XLSX? | It declares content types through defaults and part overrides. Examiners compare those declarations with actual entries and relationship targets to detect missing or inconsistent resources. |
| Can an XLSX package contain binary objects? | Yes. Images, embedded objects and other resources can be binary. A macro enabled workbook can also carry a VBA project, which requires the appropriate workbook content type. |
| What does an orphan XLSX part mean? | It is an entry not reached through the expected relationship graph. It deserves inspection, but retained resources and imperfect producers can create unused entries without deception. |
The package manifest declaring default content types by extension and overrides for particular part names.
The root relationship part that connects the package to its office document and property parts.
The relationship part resolving IDs used by the workbook into worksheets, styles, shared strings and other targets.
The URI identifying a resource from a source part; internal relative targets resolve against the source part location.
A relationship attribute distinguishing an external target from an internal package target when set to External.
Archive records listing members and their storage information, inspected alongside local records when validating the container.
Start at the package root and follow relationships. In a typical workbook, _rels/.rels identifies xl/workbook.xml. A sheet entry in that workbook contains a name, a sheetId and a relationship ID. The workbook relationship part resolves that ID to a worksheet target. Only then can an examiner assign the visible sheet label to the correct cell XML.
| Navigation stage | Example observation | Interpretation |
|---|---|---|
| Root relationship | Target xl/workbook.xml | Workbook entry point |
| Workbook sheet | name Accounts, sheetId 4, r:id rId7 | Visible label and relationship reference |
| Workbook relationship | Id rId7, Target worksheets/sheet3.xml | Resolved worksheet storage part |
| Worksheet relationship | Target ../drawings/drawing1.xml | Drawing associated with that worksheet |
The relationship ID is local to its source part. Another relationship part can contain rId7 with an unrelated target. Do not merge these identifiers into a global lookup table. Likewise, sheetId is not a filesystem name. Renaming tabs, deleting sheets and copying worksheets can leave numbering that looks irregular but is structurally valid.
A worksheet relationship target such as ../drawings/drawing1.xml is interpreted relative to the worksheet part, not relative to the relationship file's directory. Correct resolution yields the drawing part under xl/drawings. Record the original target and the resolved part name. This makes a reported missing resource reproducible and prevents a path resolution error from becoming a false allegation of deletion.
The XML parts guide explains the cells inside the resolved worksheet. Package navigation should precede that interpretation, especially when several similarly named sheets exist.
A visible sheet may rely on another worksheet, a table or an external source. We map the relationship graph before treating a produced package as a complete calculation record.
Request Confidential Consultation Call (833) 292 3733Archive entries, content declarations and relationship targets describe the same package from different angles. Compare all three. A relationship pointing to a nonexistent worksheet is a concrete defect. A declared shared string part with no references may simply be unused. The importance depends on whether the disputed content actually relies on that resource.
| Record set | Check | Material failure |
|---|---|---|
| ZIP entry inventory | Unique normalized member names and readable payloads | Duplicate names interpreted differently by readers |
| Content type manifest | Appropriate declaration for each resource | Workbook type conflicts with claimed format |
| Internal relationships | Targets resolve to existing package members | Worksheet or drawing dependency missing |
| External relationships | Target mode and referenced location documented | Source unavailable for the claimed calculation |
| XML payloads | Parse without silent repair | Reader repairs cells or relationships |
Some archive libraries select the first duplicate member while others select the last. A simple extraction can overwrite one entry and conceal the ambiguity. Inventory the archive directly, retain entry offsets and record duplicate names before extracting individual members. Review unusual member paths without writing them unchecked to disk. Extraction tools should not be permitted to escape the designated examination directory.
ZIP CRC values detect many accidental payload errors but are not cryptographic evidence hashes. Hash the acquired workbook independently and retain the raw archive. Member hashes help compare extracted resources, while the workbook digest identifies the complete delivered object. Both serve different purposes.
Archive member timestamps reflect container metadata and producer behavior. They do not form a dependable editing timeline. A conversion can rewrite every member, and a package generator can assign the same time to all entries. Use document properties alongside external version evidence rather than dating a transaction from a ZIP timestamp.
Compare both bytes and meaning. A workbook saved by another application can change compression, XML prefixes, attribute order and relationship IDs without changing a single business value. A useful structural comparison first inventories added and removed parts, then resolves sheet identity and compares the decoded content relevant to the disputed assertion.
Suppose two delivered workbooks have different hashes, and every compressed member differs. After decompression, worksheet values and formulas agree, while property dates and XML serialization differ. That supports a different finding from a workbook in which the formula at Accounts!D42 has become a constant. Report both raw identity and semantic differences. Do not describe a changed archive hash alone as proof of changed accounts.
If Excel reports a repair, retain the original package and capture the repair log on a working copy. A repaired workbook is a derived object. It may omit names, formulas, drawings or relationships that the application considered invalid. Record precisely what the application removed and whether the disputed cells were affected. The ability to open the repaired copy does not establish that the received file was structurally complete.
Package examination also identifies resources beyond worksheets: comments, drawings, embedded objects, pivot caches and connection definitions. Follow those paths where they bear on the disputed figure. A structural inventory is the map for the examination, not a substitute for evaluating the content of each material part.
Keep the received ZIP intact. Work from an archive inventory and use explicit relationship resolution before assigning business meaning to extracted members.
We produce package maps that tie each material worksheet and resource to its relationship source, allowing structural defects and version changes to be reproduced independently. The analysts doing this work are subject matter experts in XLSX file structure who read the workbook package part by part instead of trusting what Excel displays.
Elite Digital Forensics is an independent digital forensics practice serving attorneys, paralegals, in house counsel, insurers, lenders, businesses, and individuals nationwide. Our team includes former law enforcement forensic examiners and court qualified expert witnesses in computer, cell phone, cloud, document, and multimedia forensics. Every engagement begins with a scoped plan, hash verified evidence handling, and a clear explanation of what the examination can answer.
The package model uses relationships rather than requiring every conventional filename. Resolve targets and content types instead of rejecting a workbook solely for unusual naming.
Producers can regenerate relationship IDs during serialization. Compare the resolved resources and their content rather than treating an ID change alone as a material alteration.
No. It identifies stored resources but does not decode cell types, shared string indexes or styles. Those interpretation steps follow the structural map.
Record the relationship and target without automatic network access. Obtain the referenced source through authorized collection if it is needed to reproduce a disputed result.
Yes. Readers can choose different occurrences of the same member name. Preserve all entries and document the selection behavior of the parser used.
Identify the source part, relationship ID, literal target, resolved path and missing or invalid resource. Explain whether the defect affects a material cell or only an unused resource.
Send the original package and any repair messages or comparison versions. A relationship map can establish where the disputed cells reside and which dependencies must be collected. Our court qualified experts in spreadsheet forensics can explain how the workbook structure supports or contradicts its claimed history.
Request Confidential Consultation Call (833) 292 3733This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic services and expert witness testimony; we do not provide legal representation. Every case is fact specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder