Figure out the file signature/magic number for the version of Word document you are looking for. Once you work out how many bytes that is get the first n-bytes from every file using
head -c <number of bytes in signature> <filename>|hexdump then compare the output to the signature you are looking for.
Note this would work on a Linux system, you could boot the system using a Live image of Kali or BackTrack and take advantage of some of the forensics tools built-in there, or just use Debian. This would allow you to use the other tools to look at file modification times, etc to see if large batches of files were modified or renamed. If you think the files have been added/modified maliciously taking a good look at the file system using forensics tools of some sort might be a good idea before allowing it to connect to the network again.