Metadata in a MS Works Database (.WDB) file

Is there any metadata stored in a MS Works database (.WDB) file? I have tried a few tools (ExifTool/Metadata Assistant) but nothing seems to support or pull any metadata information from a .WDB file.
PvteyeAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

BillDLCommented:
Hi Pvteye

Judging from your user name you are worried about leaving sensitive content in documents, or are trying to see the data for evidential purposes.

What version of MS Works?

What Operating System are you running, (just in case any tools I might suggest may not be compatible)?

I don't have Works installed on any of my PCs, but can connect remotely to one that does later today and have a look.
0
PvteyeAuthor Commented:
I'm not sure which version of MS Works was used to create this document.

I am running Windows on the OS I am currently using but if a tool requires the use of Linux or a Mac, that shouldn't be a problem.
0
BillDLCommented:
Thanks.  I'll let you know once I create a few databases in Works over a VNC connection later today or maybe tomorrow and then analyse the files.
0
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

PvteyeAuthor Commented:
Hello BillDL. Have you had a chance to see if you can find any metadata in a Works DB? Thank you for your help.
0
BillDLCommented:
I'm sorry for not having returned to this question timeously Pvteye.  I have not yet been able to access the computer that has MS Works installed on it, but should be able to do so this weekend.
0
BillDLCommented:
Hi Pvteye

I finally managed to access a Windows XP 32-bit system running MS Works version 9 on an NTFS hard drive.

I created a couple of test databases and saved as *.WDB, but was quite surprised to see from the files' Right-Click > Properties that it had not populated the fields under the Summary tab (Advanced) as is normal with Microsoft Office.

It is possible to do so manually by double-clicking the fields, adding text, and "Applying" the changes, but it seems that this is not the default way MS Works saves its files.

I found quite a few other *.WDB files by other people using a tricky little Google search syntax to see the files on the servers, but the same is true of them also.

The ONLY metadata that I can find in the default Works database files is that which relates to the application, fonts, etc:

***** ANSI SECTION *****
0000046D:  P3w
00000888: Arial
000008B2: Times New Roman
00000986: Database Header Here
000009A2: Database Header Here
etc, etc
00000A00: Times New Roman
00000A2C: Times New Roman
00001064: Database Field Text Here
00001076: Database Field Text Here
etc, etc
00001160: Microsoft Works Database
0000117D: MSWorksDBDoc

***** UNICODE SECTION *****
00000400: Root Entry
00000480: MatOST
00001202: CompObj

There is no "Summary Information" in there by default, but in a copy of the same database to which I manually added a few details in the Summary tab, I can see the data embedded in the file, eg:

Same as above
00001160: Microsoft Works Database
0000117D: MSWorksDBDoc
00001438: BillDL
00001448: Test Works Database

***** UNICODE SECTION *****
00000400: Root Entry
00000480: MatOST
00001202: CompObj
00001282: SummaryInformation

I added content to the databases, saved the file and reopened it, then deleted the content, saved and reopened, and I can see no trace of any residual data as is the case when an MS Office file is opened and edited with the "Allow Fast Saves" option enabled.

I usually check to see whether 7-Zip is able to unpack separate content from files, and in this case it is able to.  With a "standard" *.WDB file that is devoid of that "SummaryInformation" it unpacks the files:

C:\WDB_Test\[1]CompObj
C:\WDB_Test\test\MM
C:\WDB_Test\test\MN0
C:\WDB_Test\standard.txt

C:\WDB_Test\MatOST <--- empty

Contents of files:

[1]CompObj:
00000020: Microsoft Works Database
0000003D: MSWorksDBDoc

MM:
ND

MN0:
***** ANSI SECTION *****
00000888: Arial
000008B2: Times New Roman
00000986: Database Header Here
000009A2: Database Header Here
etc, etc
00000A00: Times New Roman
00000A2C: Times New Roman
00001064: Database Field Text Here
00001076: Database Field Text Here
etc, etc

***** UNICODE SECTION *****

Unzipping the *.WDB files to which I manually added new summary information in the properties dialog unpacks files that are identical to the others with no summary information, but the SummaryInformation is extracted as the additional file "[5]SummaryInformation" which contains (hardly a surprise):

***** ANSI SECTION *****
00000078: BillDL
00000088: Test Works Database

***** UNICODE SECTION *****

I am not sure of the significance of the [1] and [5] prefixes to the CompObj and SummaryInformation files, but these are in common with what is unpacked from within an old style (Office 97-2003) *.doc, *.xls, etc file.  It would imply that the file can possibly store data in areas that would be unpacked with a [2], [3], [4], and possibly higher prefixes.

For example, unpacking a basic Word 97 *.doc with a few tables and embedded images I get these files:
[1]CompObj
[5]DocumentSummaryInformation <--- additional data but still with [5]
[5]SummaryInformation
0Table
1Table
WordDocument

Incidentally, I cannot unpack an MS Office *.MDB file with 7-Zip.

I think that the relative simplicity of a the extractable data in an MS Works database stems from the relative simplicity of the Microsoft Works Database application and it's intended target audience.   Probably something like 2% of people who buy a computer with MS Works installed actually open the Database, and of those who do I would guess that a significant number of them only go as far as to crate a shopping list of telephone book.

Perhaps more recent versions of Works may create more complex metadata, but I do not have any access to any version more recent than 9, and don't have any files to examine.

I will look into the [1], [5] aspect when I have some time.

Bill
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
PvteyeAuthor Commented:
What did you use to pull the ANSI and UNICODE information?
0
BillDLCommented:
It's a little shell extension named Peek, by an Austrian guy named Martin Lubich.  It was last updated in 1998 (version 1.1), but works perfectly well up to Windows XP.  I believe that somebody on E-E previously tested this in Windows 7 and it didn't work, but I can't be sure.  I have been unable to find a site owned by the author with a download link, and I think the usual download sites have an older version.

The full program name is "PEEK Shell Context Menu Extension".  It is just a DLL file named, unsurprisingly, "peek.dll" and "peek.INF" which is used to install it to "C:\%WinDir%\system32\ShellExt" on a WinXP system.

It adds a new Right-Click menu to all files named "Peek" with a sub-menu giving the options:  Binary, Standard, and Unicode.  It extracts as much of the textual content as it can from the target file to a new "PEEK.TXT" file in the logged-on user's %TEMP% folder and opens it in the default viewer, which in most cases will be Windows Notepad.  The temp file remains, but is overwritten with each subsequent "peek".  Only once in a blue moon have I had the issue with it hanging my system, and that has been when I was messing with an in-use system file.

The installation creates a new registry key:
[HKEY_LOCAL_MACHINE\SOFTWARE\Aries\Peek]
which stores the default settings relating to each of the Right-Click menu options.  These are modifiable, and details can be found in the Readme, but I have never had cause to change any.

The *.INF file used to install the shell extension also creates the following registry keys and values so that it shows as a shell extension:
 
[HKEY_CLASSES_ROOT\CLSID\{147C4760-0B2C-11D0-BD4A-00001C5002DB}]
Points to the DLL

[HKEY_CLASSES_ROOT\*\ShellEx\ContextMenuHandlers\PeekContext]
Tells it the {GUID}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"Peek Text Extraction"

Open in new window


You just Right-Click the *.INF file and choose "Install".  A listing is created in the Add/Remove Programs list.

Seeing as I have been unable to find a download link by the author I don't think there is any harm in attaching it, but I take no responsibility for the consequences of use on Windows Vista or 7, on which I have never personally tested it.

I have had to rename the DLL and INF files in the ZIP file to *.TXT, so just rename them back if you intend to try it.
 Peek-v1-1.zip

That is the tool which I use very frequently, but I also use a hex editor, various text editors, and other miscellaneous GUI and command line tools for looking into files.  Please note that this is not anywhere near the depth that a Forensic Investigator would delve to in examining files, but it reveals as much to me as I usually need to see.

Bill
0
PvteyeAuthor Commented:
The tool does work in Windows 7 by the way. Thank you for your help with this.
0
BillDLCommented:
Thank you Pvteye, and thank you also for confirming that the shell extension works in Win7.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Applications

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.