TZWorks LLC
System Analysis and Programming
www.tzworks.com


TZWorks®
MS Office Backstage Parser - bs

(Version 0.23)



Information about our End User's License Agreements (EULAs)
for software on TZWorks, LLC Website www.tzworks.com

User Agreement

TZWorks LLC software and related documentation ("Software") is governed by separate licenses issued from TZWorks LLC. The User Agreement, Disclaimer, and/or Software may change from time to time. By continuing to use the Software after those changes become effective, you agree to be bound by all such changes. Permission to use the Software is granted provided that (1) use of such Software is in accordance with the license issued to you and (2) the Software is not resold, transferred or distributed to any other person or entity. Refer to your specific EULA issued to for your specific the terms and conditions. There are 3 types of licenses available: (i) for educational purposes, (ii) for demonstration and testing purposes and (iii) business and/or commercial purposes. Contact TZWorks LLC (info@tzworks.com) for more information regarding licensing and/or to obtain a license. To redistribute the Software, prior approval in writing is required from TZWorks LLC. The terms in your specific EULA do not give the user any rights in intellectual property or technology, but only a limited right to use the Software in accordance with the license issued to you. TZWorks LLC retains all rights to ownership of this Software.

Export Regulation

The Software is subject to U.S. export control laws, including the U.S. Export Administration Act and its associated regulations. The Export Control Classification Number (ECCN) for the Software is 5D002, subparagraph C.1. The user shall not, directly or indirectly, export, re-export or release the Software to, or make the Software accessible from, any jurisdiction or country to which export, re-export or release is prohibited by law, rule or regulation. The user shall comply with all applicable U.S. federal laws, regulations and rules, and complete all required undertakings (including obtaining any necessary export license or other governmental approval), prior to exporting, re-exporting, releasing, or otherwise making the Software available outside the U.S.

Disclaimer

The user agrees that this Software made available by TZWorks LLC is experimental in nature and use of the Software is at user's sole risk. The Software could include technical inaccuracies or errors. Changes are periodically added to the information herein, and TZWorks LLC may make improvements and/or changes to Software and related documentation at any time. TZWorks LLC makes no representations about the accuracy or usability of the Software for any purpose.

ALL SOFTWARE ARE PROVIDED "AS IS" AND "WHERE IS" WITHOUT WARRANTY OF ANY KIND INCLUDING ALL IMPLIED WARRANTIES AND CONDITIONS OF MERCHANTABILITY, FITNESS FOR ANY PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT SHALL TZWORKS LLC BE LIABLE FOR ANY KIND OF DAMAGE RESULTING FROM ANY CAUSE OR REASON, ARISING OUT OF IT IN CONNECTION WITH THE USE OR PERFORMANCE OF INFORMATION AVAILABLE FROM THIS SOFTWARE, INCLUDING BUT NOT LIMITED TO ANY DAMAGES FROM ANY INACCURACIES, ERRORS, OR VIRUSES, FROM OR DURING THE USE OF THE SOFTWARE.

Removal

The Software are the original works of TZWorks LLC. However, to be in compliance with the Digital Millennium Copyright Act of 1998 ("DMCA") we agree to investigate and disable any material for infringement of copyright. Contact TZWorks LLC at email address: info@tzworks.com, regarding any DMCA concerns.


About this Tool (top)

With the newer versions of Microsoft (MS) Office programs, when you first start Office you will be presented with the Backstage view. From this view, you can create a new document (using a pre-created template) or open an existing file. One can also see the most recently used files listed on the left side of the view.

If you are currently viewing or editing a file, and you want to go back to the Backstage view, one just selects the File tab.

In order for MS Office to render the history data, it makes use of some persistent information stored on the computer. For MS Office 2016, this file history data is contained in a new set of files located in the MyComputer folder or other folders that designate remote shares.

    C:\Users\<acct>\AppData\Local\Microsoft\Office\16.0\BackstageInAppNavCache\[MyComputer or other remote dir]

The files residing in this directory can be either delimited text or json formatted text. These files have long names that consist of a 64-character string. The string is actually a representation of a 32-byte hexadecimal hash which results from the computation of certain contents of the artifact file that relate to a primary directory. This, in turn, allows unique names files to be generated.

When parsing the data in backstage files, of interest to the analyst is the data that contains references to file and folder paths (both local and remote), each timestamped with the last modified time. So, while the records identify files and folders used in the past, it doesn't necesarily mean they still exist on the system. Therefore, this data can be good in identifying user activity in conjunction with certain files even after these same files may have been deleted or moved elsewhere.


How to use this Tool (top)

Below is the menu with the various options available. Details of each option can be found here.

    Usage
 
      bs -file <backstage file> [options]

     Basic options
      -csv                             = output in CSV format (default)
      -csvl2t                          = log2timeline output
      -bodyfile                        = sleuthkit output

     Additional options
      -csv_separator "|"               = use a pipe char for csv separator
      -dateformat mm/dd/yyyy           = "yyyy-mm-dd" is the default
      -timeformat hh:mm:ss.xxxxxx      = "hh:mm:ss.xxx" is the default
      -no_whitespace                   = remove whitespace between csv delimiter
      -pipe                            = pipe files into tool for processing
      -quiet                           = no progress shown

     Usage Examples
      bs -file <backstage file>        = parse one file
      dir <folder> /b /s /a | bs -pipe = parse many files
      bs -enumdir <folder> -num_subdirs <#> [options]

     Experimental options
      bs -compute_name                 = compute the name using file internals

The most basic option is to parse an individual file. One does this by using the -file <argument> option. This takes the artifact path/file as an argument. The tool can sense, based on the file contents, whether the data is pipe delimited text or JSON formatted text so no extra parameters are required to be passed in by the user to process either the older or newer formatted files. Once the tool determines the format, the data is parsed into individual records.

The default output uses a CSV variant that separates fields with pipe delimiters. One can specify other delimiters as well, by using the -csv_separator <delimiter arg>. The delimiter argument can be one of 3 characters: comma, pipe or tab. One can also output the parsed data in the common Log2Timeline format (-csvl2t), if desiring to merge this artifact data with other artifacts to create a timeline of activities.

If desiring to parse many files contained in a folder, one can use the -pipe option to process an entire folder and child subfolders in one session. Since the tool can sense between the different artifact internal formats, one can mix and match older and newer formatted files during this process. An example to do this is shown in the default command-line menu output subtitled "Usage Examples" that is shown above.

The last option worth mentioning is an experimental option that computes the name of the artifact file by using certain contents of the Backstage file. One invokes this via the -compute_name switch. This can be used with either the -file <argument> option or the -pipe option. This is useful to see if the contents (or the name) of the file have changed either via corruption or if done intentionally.


List of options (top)

Option Description
-file Specifies which file to act on. The format is: -file <BackstageInAppNavCache db to parse>.
-csv Outputs the data fields delimited by whatever delimter is specified. Since filenames can have commas, to ensure the fields are uniquely separated, any commas in the filenames get converted to spaces.
-csvl2t Outputs the data fields in accordance with the log2timeline format.
-bodyfile Outputs the data fields in accordance with the 'body-file' version3 specified in the SleuthKit. The date/timestamp outputted to the body-file is in terms of UTC. So if using the body-file in conjunction with the mactime.pl utility, one needs to set the environment variable TZ=UTC.
-pipe Used to pipe files into the tool via STDIN (standard input). Each file passed in is parsed in sequence.
-enumdir Experimental. Used to process files within a folder and/or subfolders. Each file is parsed in sequence. The syntax is -enumdir <"folder"> -num_subdirs <#>.
-filter Filters data passed in via stdin via the -pipe option. The syntax is -filter <"*.ext | *partialname* | ...">. The wildcard character '*' is restricted to either before the name or after the name.
-no_whitespace Used in conjunction with -csv option to remove any whitespace between the field value and the CSV separator.
-csv_separator Used in conjunction with the -csv option to change the CSV separator from the default comma to something else. Syntax is -csv_separator "|" to change the CSV separator to the pipe character. To use the tab as a separator, one can use the -csv_separator "tab" OR -csv_separator "\t" options.
-dateformat Output the date using the specified format. Default behavior is -dateformat "yyyy-mm-dd". Using this option allows one to adjust the format to mm/dd/yy, dd/mm/yy, etc. The restriction with this option is the forward slash (/) or dash (-) symbol needs to separate month, day and year and the month is in digit (1-12) form versus abbreviated name form.
-timeformat Output the time using the specified format. Default behavior is -timeformat "hh:mm:ss.xxx" One can adjust the format to microseconds, via "hh:mm:ss.xxxxxx" or nanoseconds, via "hh:mm:ss.xxxxxxxxx", or no fractional seconds, via "hh:mm:ss". The restrictions with this option is that a colon (:) symbol needs to separate hours, minutes and seconds, a period (.) symbol needs to separate the seconds and fractional seconds, and the repeating symbol 'x' is used to represent number of fractional seconds. (Note: the fractional seconds applies only to those time formats that have the appropriate precision available. The Windows internal filetime has, for example, 100 nsec unit precision available. The DOS time format and the UNIX 'time_t' format, however, have no fractional seconds). Some of the times represented by this tool may use a time format without fractional seconds and therefore will not show a greater precision beyond seconds when using this option.
-quiet Show no progress during the parsing operation
-compute_name Computes the name of the Backstage file by looking at the file internals
-utf8_bom All output is in Unicode UTF-8 format. If desired, one can prefix an UTF-8 byte order mark to the CSV output using this option.

Known Issues (top)

For csv (comma separated values) output, there are restrictions in the characters that are outputted. Since commas are used as a separator, any data that had a comma in its name is changed to a semicolon. For the default (non-csv) output no changes are made to the data.

(Windows only) When processing filenames with characters that are not ASCII, one option is to change the code page of the command window from the default code page to UTF-8. This can be done via the command:

    chcp 65001

If running on a Windows operating system post XP and running under admin permissions, any network shares established prior as a regular (non-admin) user, will be isolated from other accounts (including the admin account). This problem occurs because User Account Control (UAC) treats members of the Administrators group as standard users. Therefore, network shares that are mapped by logon scripts are shared with the standard user access token instead of with the full administrator access token.


Authentication and License File (top)

This tool has authentication built into the binary. The primary authentication mechanism is the digital X509 code signing certificate embedded into the binary (Windows and macOS).

The other mechanism is the runtime authentication, which applies to all the versions of the tools (Windows, Linux and macOS). The runtime authentication ensures that the tool has a valid license. The license needs to be in the same directory of the tool for it to authenticate. Furthermore, any modification to the license, either to its name or contents, will invalidate the license.

Limited versus Demo versus Full in the tool's output banner

The tools from TZWorks will output header information about the tool's version and whether it is running in limited, demo or full mode. This is directly related to what version of a license the tool authenticates with. The limited and demo keywords indicates some functionality of the tool is not available, and the full keyword indicates all the functionality is available. The lacking functionality in the limited or demo versions may mean one or all of the following: (a) certain options may not be available, (b) certain data may not be outputted in the parsed results, and (c) the license has a finite lifetime before expiring.


Version history (top)


References (top)

  1. G-C Partners Daily Blog #510, 18 Oct 2018. Office 2016 Backstage Artifacts.
  2. https://blogs.technet.microsoft.com/office2010/2009/07/15/microsoft-office-backstage-part-1-backstory
  3. https://blogs.technet.microsoft.com/office2010/2009/08/11/microsoft-office-backstage-part-3-the-info-tab