- Nationwide Digital Forensic & Cyber Investigation Services
Decode cell types, text indexes, style references and retained data sources before interpreting the numbers in an extracted worksheet.
Home › Digital Evidence Authentication › Excel Spreadsheet Authentication › XLSX XML Parts and What They Contain
Quick Answer. XLSX worksheet XML stores typed cell records, not a plain text copy of the visible grid. A cell can reference shared text, hold a number governed by a style, or contain a formula and cached result. Examiners combine workbook, worksheet, shared string and style parts, then inspect caches and external links to understand what the stored records represent.
This technical chapter of Excel Spreadsheet Authentication explains how SpreadsheetML records become displayed cells. Use package relationship mapping to locate the parts first. For disputed expressions, continue to formulas and cached values. Reading a v element without its cell type or style can turn a text index into an amount or a date serial into an ordinary count.
| Question | Short answer |
|---|---|
| What does c r="B7" t="s" mean in worksheet XML? | It identifies cell B7 as a shared string cell. Its v value is a zero based index into xl/sharedStrings.xml, not the text itself or a numeric amount. |
| Where does XLSX XML store worksheet formulas? | The cell f element stores the formula expression. Its v element can store the last saved result. The expression and the saved result must be interpreted separately. |
| Does XLSX XML put every cell in sharedStrings.xml? | No. Numeric cells store numeric values, and text can also use inlineStr with an is element. Shared strings are one text representation, not a mandatory repository for every cell. |
| What does a worksheet XML s attribute identify? | It is an index into cellXfs in the stylesheet. That format record can specify number format, font, fill, border and other presentation settings. |
| What can XLSX pivotCacheRecords contain? | A retained pivot cache can hold source record values used by a pivot table. Decode them with the associated cache definition rather than treating raw indexes as labels. |
| Why inspect XLSX externalLinks parts? | They describe external workbook references and can retain cached sheet names or values. The linked source and the retained cache are distinct evidence objects. |
The worksheet cell attribute assigning a coordinate such as B7; sparse XML need not contain every blank coordinate.
The integer in a shared string cell's v element selecting an si entry from the shared string table.
A cell type and child structure that store text directly in the worksheet rather than through the shared string table.
The stylesheet collection of cell formatting records indexed by worksheet cell s attributes.
A part describing pivot cache fields and source information needed to interpret retained cache records.
Workbook resources describing links to other workbooks, including relationship targets and sometimes cached external values.
A worksheet is sparse. A row contains cell elements for stored content, but absent coordinates do not automatically mean a deletion. The r attribute names the cell. The t attribute selects a value type. A cell with t="s" uses its v value as a shared string index; an inline string instead contains an is structure. Numeric cells commonly omit t or use n.
| Cell observation | Lookup required | Decoded meaning |
|---|---|---|
| c r="B7" t="s", v 4 | Fifth si entry in sharedStrings.xml | Shared text at B7 |
| c r="C7", v 1250 | Style for display context | Stored numeric value 1250 |
| c r="D7" t="b", v 1 | Boolean interpretation | True |
| c r="E7" t="inlineStr" | Text inside is | Inline text, including possible rich text runs |
| c r="F7" t="e" | Error text in v | Saved error such as #DIV/0! |
The table index starts at zero. Index 4 selects the fifth string item, not the fourth. Shared string items can contain rich text runs; concatenate the intended text while retaining the original run structure for inspection. Preserve significant whitespace and XML escaping. A search limited to plain worksheet text will miss labels stored only in sharedStrings.xml.
Worksheet dimensions and row indexes help navigation, but formatting and prior edits can extend used ranges. Count actual records according to a defined business key. Likewise, merged cells store their principal content at an anchor coordinate; empty members of the merged range do not represent missing transactions. Retain merge definitions when explaining an exported table.
The hidden data guide addresses visibility. A parser should extract cells irrespective of their current display state, then apply visibility information as a separate annotation.
A raw value of 12 might be text index 12, twelve units or a date serial. We preserve the cell type and style context so that extracted evidence retains its actual meaning.
Request Confidential Consultation Call (833) 292 3733Styles determine presentation and often the intended interpretation of a numeric value. The worksheet s attribute indexes cellXfs in xl/styles.xml. A selected format record supplies a numFmtId, which can refer to a built in format or a custom numFmt definition. Record both the underlying value and the format code.
| Stored layer | Example | Interpretive consequence |
|---|---|---|
| Numeric v | 0.25 | Raw number before formatting |
| Percentage format | 0% | Displays 25% while retaining 0.25 |
| Decimal format | 0.00 | Displays rounded digits without changing raw value |
| Date format | A calendar display pattern | Interprets numeric serial as a date display |
| Concealing format | ;;; | Can suppress displayed cell content |
Check workbookPr date1904 before converting serial dates. Excel supports 1900 and 1904 date systems; corresponding serials differ by 1462 days. The 1900 system includes the fictitious 29 February 1900 at serial 60 for historical compatibility. A converter that silently applies a normal Gregorian calendar can misinterpret early serials. Record the raw number and selected date system even when the disputed records are modern.
A fractional day represents time within a day. It supplies no timezone by itself. Do not attach a timezone merely because the examiner's computer uses one. Compare the source system's date conventions and export behavior before aligning worksheet dates with server events.
Excel numeric precision is limited to 15 significant decimal digits. Long account identifiers should normally remain text. A displayed amount rounded to two decimal places can retain more fractional precision internally; sums of raw amounts can therefore differ from sums of displayed rounded values. Explain the calculation basis rather than attributing the difference to an XML inconsistency.
Supporting parts can explain where displayed values came from and what data survives outside the grid. xl/calcChain.xml, when present, lists calculation chain entries. It is optional and can be removed or rebuilt by applications. Its absence is not proof that the workbook never had formulas, and its presence does not supply an editing journal.
Pivot caches can preserve source categories and records even when the current pivot view displays only summaries. A cache definition describes fields and shared items; pivotCacheRecords can contain indexed values interpreted through that definition. Compare the cache's source range or connection with the current source sheet. A difference may reflect a refresh boundary, not a secret second ledger.
External link parts can retain workbook references, sheet names and cached cell data. Their relationships may identify a file path or network location. Record those references without opening them automatically. A cached external value shows what the workbook retained, not what the external source contains today. If a disputed formula depends on that source, collect the appropriate historical version.
Other parts include table definitions, comments, drawings, connections and query resources. Their relevance follows the disputed issue. An embedded object can be a separate source schedule; a table range can define which records feed a total. Record the exact part path and XML element used for each finding so that another examiner can reproduce the interpretation from the preserved package.
Keep raw XML and decoded output together. Each extracted value should remain traceable to its sheet, coordinate, type, style and supporting lookup record.
We tie decoded spreadsheet values to their original XML coordinates and lookup records, preserving the context needed to explain dates, text references, cached sources and formatted amounts. Because our examiners are subject matter experts in SpreadsheetML, they can trace a value from the worksheet XML to the shared strings table and the calculation chain.
Elite Digital Forensics is an independent digital forensics practice serving attorneys, paralegals, in house counsel, insurers, lenders, businesses, and individuals nationwide. Our team includes former law enforcement forensic examiners and court qualified expert witnesses in computer, cell phone, cloud, document, and multimedia forensics. Every engagement begins with a scoped plan, hash verified evidence handling, and a clear explanation of what the examination can answer.
Yes. A cell can retain formatting without a value. Distinguish stored empty cells, absent coordinates and business records rather than counting every c element as a transaction.
A formula cell can include a v element containing its saved result, interpreted with the cell type and style. Preserve that result before any recalculation.
The workbook may use the 1904 date system rather than the 1900 system. Apply its date1904 setting before comparing calendar dates across files.
Yes. A string table can contain unused entries. Determine whether cells reference an entry before claiming it represents a current worksheet record.
No. Initial inspection should preserve retained data and record targets without network refresh. Refreshing creates a different calculation state and can overwrite useful cached evidence.
Provide the package digest, worksheet binding, coordinate, raw type and value, lookup index and style context. Another examiner should be able to recover the same interpretation from those records.
For a disputed cell, collect its native package rather than a text dump alone. Type, shared string, style and source references can determine what the raw XML actually means. We are court qualified experts in Excel forensics and can turn XML level findings into exhibits a jury can follow.
Request Confidential Consultation Call (833) 292 3733This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic services and expert witness testimony; we do not provide legal representation. Every case is fact specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder