Does anyone know of a way to determine which version of Excel was used to create a file? We have some .xls files and need to determine the version. They open fine in Excel 2007 and higher, but a co-worker wants to determine their exact original version.
I've examined hex dumps to do similar forensics on .doc and image files, but I can't find anything particularly useful in the .xls file and the extended properties don't seem to help either.
Microsoft KB 178605: How To Determine the Version of a Microsoft Excel Workbook (snapshot)
Microsoft Excel saves data using structured storage. In particular, it creates a data stream called "Workbook" (previously just "Book") where it saves the contents starting with a BOF (beginning of file) record. This record contains useful attributes of the workbook, as well as the version.
That article goes on to give sample C++ code to dump this information.
Also see, Stackoverflow,
How to identify whether an Excel file conforms to Excel 95 or Excel 97 specifications?
You could also save the excel file with the .zip extension. Then open that archive and look in the docProps folder. Open the app.xml and check the AppVersion node:
16.0300
As far as I know, in the Meta Data it simply stores it as "Microsoft Excel".
Other than looking at the file for the version e.g. .xlsx for 2007 and 2010, or .xls for 97-2003 (could be older, but unlikely), I am not sure there is a good way to find out.
Why does your co-worker want to know? If you say what the goal is other than finding the version number, I may be able to help you find another way of achieving it.
