Is an Excel file a true Excel file?

Posted on 2012-09-13
Last Modified: 2012-11-18
Here's a little history on the issue:

I hired contractor 1 to push data from a MSSQL SELECT stored procedure into an Excel 2003 spreadsheet using my ASP.NET interface. The sneaky little #%!# tried to fake it. He pushed my SELECT stored procedure data into an HTML table and assigned an XLS file extension to the file. Sure enough, Excel opened the file, but it wasn't a true Excel file.

Contractor 1 is gone. Enter contractor 2. I hired him to do the same thing. I'm reasonably sure that his work is genuine. I've attached it. Are there clues I can look for in the metadata to assure it is a "true" Excel file?
Question by:jdana
    LVL 5

    Assisted Solution

    I'm a little confused, both are "true" Excel files so what's the issue with the approach?

    The method he used is quite common, so is pumping out data as csv and changing the extension in the same manner.

    Why wouldn't this be an acceptable approach?
    LVL 11

    Assisted Solution

    Simple test is files saved in excel format cannot be opened or edited by text editors.
    LVL 4

    Accepted Solution

    Hi jdana,

    Well, there is the Office Validation Tool add-on. However, I think it's focused on checking for malicious code, so if one simply changes the extension I don't think it will notify you.

    What you can do, if you feel like it, is comparing the header code, as a file signature. For instance, if you open Excel files with PEview, you can see that they start with a specific Hex code, while a text file that was renamed as an Excel file will not have the same header.

    There might be an automatic tool that can validate this, instead of checking manually for the header code, but I don't know any such tool.

    If you're interested in this solution I'd be glad to explain more if needed.

    I checked the sample file, and it seems it has a correct Excel header of "d0 cf 11 e0 a1...." as you can see here:

    Last Edit:
    I'm leaving my answer here just for the information if it can be useful to you, but it's not really a good solution for you, since it will only work if the file format was changed and that's it. However, if once it was changed the user also opened the "Excel" file and re-saved it as an Excel file, it will have a regular Excel header, so you won't know if it was originally created with Excel (and I don't think you could ever know once he re-saves the file with Excel).
    LVL 26

    Expert Comment

    Edit: Apologies all - incorrect post removed.

    Author Closing Comment

    Great answers guys.

    KyleSW - Your suggestion that an HTML format may be acceptable is a good one.

    Featured Post

    Enabling OSINT in Activity Based Intelligence

    Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

    Join & Write a Comment

    Suggested Solutions

    It was really hard time for me to get the understanding of Delegates in C#. I went through many websites and articles but I found them very clumsy. After going through those sites, I noted down the points in a easy way so here I am sharing that unde…
    If you need to start windows update installation remotely or as a scheduled task you will find this very helpful.
    This Micro Tutorial will demonstrate how to use a scrolling table in Microsoft Excel using the INDEX function.
    Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

    729 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    23 Experts available now in Live!

    Get 1:1 Help Now