22

I drafted something in a Word document and then made some changes before emailing it. Can the person receiving the document see or roll back to previous edits?

If they can, how can I prevent that?

  • 1
    To prevent them from changing the document, you can send it as something other than a word doc, typically a pdf. Or, you can get rid of tracked changes, save it, and send it with a checksum -- they can edit the file, but then it won't match the checksum. – mpez0 Jun 19 at 21:18
  • 5
    Note: in really old versions of Word (think Word 97-2003) they could. This was a real security problem. – user253751 Jun 19 at 22:49
  • @user253751 sounds cool, could you make that an answer with a bit more information? Perhaps not entirely useful to the OP, but certainly good for completeness. – Saaru Lindestøkke Jun 19 at 23:02
  • 1
    Don't forget Previous Versions. That's likely enabled if the file is stored on a network share. – InterLinked Jun 20 at 12:37
  • 1
    @SaaruLindestøkke Long story short, .doc files have a tiny filesystem inside them and appending to it was noticeability faster on old hardware than rewriting, so changes were only appended most of the time to improve user experience. Only every few saves Word actually rewritten entire file. I think they disabled it in 2003 and a patch was released for 2000. – gronostaj Jun 21 at 19:21
31

It's not as straightforward as the initial revision of the answer of Guest suggests.

Can others see my edits?

I think there are a couple cases with Word files (tl;dr conclusion in parenthesis):

  1. Track changes disabled (✔: nobody can see your edit history)
  2. Track changes enabled (❗ people might see your edit history)
  3. Hosted online in Google Docs, OneDrive, Sharepoint, the cloud (❗ people might see your edit history)

Track changes disabled

Track changes allows you to make changes, while the old text remains available. You can check in the Review panel if Track Changes is on or off (here it's off):

enter image description here

In this case you can safely edit the document, save it, and send it as an attachment without anyone finding out what you've changed.

Track changes enabled

If track changes is enabled, people can see what you've changed. Here it's enabled: enter image description here

In case it's enabled and my original text looks like this:

enter image description here

I can make changes, and then it looks like this if I enable All Markup in the tracking settings: enter image description here

However, if I set it to No Markup it looks as if the old text is not there anymore: enter image description here

Yet it is! If you would send a Word document by e-mail while you've made changes with Track Changes enabled, someone could easily find what changes you've made.

And you wouldn't be the first to fall for it. Here's a list of large serious organizations that made the same mistake, disclosing draft versions of their document unintentionally.

Hosted online in Google Docs, OneDrive, Sharepoint, the cloud ☁

There's no uniform answer for all the different cloud providers, but often they keep a history of your file for 30-90 days. If you send your document as a link to the document hosted online instead as an attachment it could very well be that the receiver can see the full history.

How do I make sure others cannot see my changes?

Several options, but it depends on what your requirements are. Below a few suggestions.

  • If formatting is of no concern you can copy-paste the text into a plain text file, the e-mail itself or a new document
  • If track changes was on, accept all changes, turn off track changes and save your file.
  • You can also print to PDF, after you accepted all changes (or selected No Markup in the tracking menu)
| improve this answer | |
  • Normally at default track changes is disabled so anyone who dont want to save tracks of edit would not turn that feature at all so I did not mention that straightforward solution before – EliteX Jun 21 at 9:41
  • In my experience normally and at default can mean different things at different computers, so that's why I think your first answer revision was not sufficient. Also, as the link to examples where track changes went wrong in the public shows, it's not that straightforward. – Saaru Lindestøkke Jun 21 at 9:46
  • Now since I have improved my answer can you remove the link superuser.com/revisions/1562134/1 in your answer it dont looks good you could simply say that without pointing link – EliteX Jun 21 at 9:49
  • I'm not sure I understand what your concern is. Feel free to propose an edit to my answer (removing any lines you feel are offending) and let the community approve/reject it. Also on the default thing: here's a question with 97k views that asks how to stop track changes turning on automatically. – Saaru Lindestøkke Jun 21 at 9:56
  • Proposed but kindly skip or dont accept but dont reject – EliteX Jun 21 at 9:59
16

One thing that I don't think anyone's mentioned yet is the Inspect Document tool. This lets you check for (and then optionally remove) things like unresolved tracked changes, along with various other types of content you might not want to share with other users.

(This means you don't have to rely on going through the tracked changes choosing accept/reject, and just hope you don't miss any - the Document Inspector can tell you for certain.)

Go to File -> Info to see this tool:

Info menu options in Word

If you click on Check for Issues -> Inspect Document, you can choose to check the document for various types of content. Once the Document Inspector has run it'll give you the option to remove anything it finds:

Document Inspector results

Any tracked changes will be in that top category. I think clicking to remove revision marks, will 'solidify' the current version of the document and remove the "Track changes" marks showing previous versions. So if you've run the Document Inspector and it does find this stuff, you may want to close and go back to manually resolve the revisions (accept/reject) to make sure you end up with the version you want.

The Protect Document tool lets you restrict what people can do with the document (like make it read-only), though I'm not sure if it could prevent them from just saving a copy to then edit. There's also an option to add a digital signature, which I think would let you verify later whether it had been changed, but I'm afraid I've never tried that feature.

| improve this answer | |
  • 7
    Full disclosure: I most often use this to remove the "Document Properties and Personal Information" stuff when I've been working on something very late at night, and don't want them to see the "Created at 01:24:08" timestamp and then judge for my terrible personal routines... 😅 – Tim Jun 21 at 0:46
  • 1
    Note that this is called "Prepare for Sharing" in Office 2010. – Prometheus Jun 22 at 18:41
10

Note:Track changes is disabled by default but still you should check if you enabled by mistake

Turn off track changes Go to Review > Track Change enter image description here

Remove tracked changes To permanently remove any markup, accept or reject changes and delete comments. Select Review > Next > Accept or Reject. enter image description here

| improve this answer | |
10

If this is the newer "docx" format, and not the older format, you can easily verify whether the deleted content exists. docx format is simply a zip file containing the document text and meta-data.

If you unzip the file you will get directories that look something like this:

./[Content_Types].xml
./docProps/app.xml
./docProps/core.xml
./_rels/.rels
./word/fontTable.xml
./word/document.xml
./word/settings.xml
./word/webSettings.xml
./word/styles.xml
./word/theme/theme1.xml
./word/_rels/document.xml.rels

The main content of the document is in word/document.xml. If you open that file you can search for your deleted content to verify it isn't there.

To be on the safer side, you can even search through all the files. It helps to be comfortable with the command line.

This example uses UNIX utilities, but there are similar utilities in Windows such as FINDSTR or PowerShell's select-string (please refer to the Windows documentation).

I wrote a docx file containing 'Hello, this is my-super-secret-password' then ran:

$ unzip -p ~/my_document.docx | grep -i super-secret-password
...<w:r><w:t xml:space="preserve">Hello, this is </w:t></w:r><w:r w:rsidR="004A0F56"><w:t xml:space="preserve">my-super-secret-password. </w:t></w:r>...

$

(output abbreviated for clarity).

I then deleted the string and ran the command again and there was no output:

$ unzip -p ~/my_document.docx | grep -i super-secret-password

$

This was with "Track Changes" off. I tried the same again with "Track changes" on and sure enough, even if it was not in the document it is in the document.xml file:

$ unzip -p ~/my_document.docx | grep -i super-secret-password
...<w:r><w:t>Hello, this is</w:t></w:r><w:del w:id="0" w:author="John Doe" w:date="2020-06-19T17:40:00Z"><w:r w:rsidDel="00835B5E"><w:delText xml:space="preserve"> </w:delText></w:r><w:r w:rsidR="00835B5E" w:rsidDel="00835B5E"><w:delText>my-super-secret-password</w:delText></w:r></w:del>...

It does get a bit more complicated if you deleted only part of the string, because it will split up the part that you deleted with XML. To be entirely, 100% sure, you would have to read the XML files at least in the general area where the edits were made. If you feel the need to look up a tag, you can reference the publicly available specification, (look for ISO/IEC 29500), although it shouldn't be necessary to read the entire 1500+ pages.

Under normal circumstances, as long as you don't have "Track Changes" on, there is no way for the recipient to recover the data you deleted. But if you are really concerned, you can always verify this by inspecting the raw data of the document.

| improve this answer | |
  • I like the creativity, but the sentence It does get a bit more complicated if you deleted only part of the string, because it will split up the part that you deleted with XML. worries me. What if you put a linebreak or space by accident in the super-secret-password (or other phrase)? It doesn't seem to by like a waterproof method, and e.g. printing to PDF seems safer. – Saaru Lindestøkke Jun 19 at 22:24
  • 3
    I hate to be that person to promote their own answer as a comment on someone else's but... Word has built-in tools to inspect your document for stuff like this (and optionally remove it). It's cool to see how you can play around with the internals of a Word doc in the command line, but since it's a piece of packaged software there's happily also a "packaged software" solution that we can also use :) – Tim Jun 21 at 0:41
  • 1
    I was not aware of the Inspect Document tool, very good to know! With this answer, yes I was primarily trying to show that it's simply zipped text files under the hood. – Possum Jun 21 at 20:37
  • @SaaruLindestøkke You are correct, you would need to carefully inspect the XML file(s) to be entirely sure, and I agree printing to PDF or copy/pasting to a new document would be safer. The scenario I was imagining is that the user had already transmitted the docx and needs to confirm that the recipient cannot see the deleted data, for example if they need to raise the alarm that sensitive data had leaked or not. I edited my answer to improve the wording and also link to the official spec. – Possum Jun 21 at 20:54
  • 1
    @Tim I did not find your tone unfriendly in the least, and I appreciate your input! Thankfully the older ".doc" format is pretty much phased out everywhere; those files were a pain to deal with programatically. – Possum Jun 23 at 18:05
8

The other answers already addressed the technical aspects of the question, so I would like to mention two things:

  • Unless you are writing in collaboration, there is never the need to send a Word document. In particular if you have worries of the legal kind. You may write in Word, but send a PDF.

  • If for some reason you really need to send a Word document, when you have it ready start a new document and copy-paste the contents into it. Send the new one.

| improve this answer | |
  • 2
    I am taking a writing course at a community college right now, and the instructor requires doc/x format to be submitted. I objected, since LaTeX→PDF is easier to write in and can be typeset to be prettier. The professor's argument was that their plagiarism detection tool can only handle doc/x (which seems odd but whatever). – Possum Jun 21 at 21:09
  • 2
    I guess, there is sometime the need... I feel for you. – Martin Argerami Jun 21 at 21:17
  • 3
    pandoc to the rescue! Markdown is even easier than LaTeX, you can convert markdown to LaTeX and back with pandoc, for example. But it also can convert markdown to docx! So, you can fully separate the writing and the submission formats. – Oleg Lobachev Jun 21 at 23:47
  • 1
    @Possum Word can be equally be easier (if not much easier due to the learning curve) to write in and can be typeset to be prettier, once you've mastered the features. Do you things like Word fields, styles...? The reason regarding plagiarism detection tool sounds valid, because once rendered into PDF almost all information about lines and paragraphs are lost. That's why converting a PDF file to an editable document is so difficult – phuclv Jun 22 at 7:41
  • "Easier" is indeed subjective. I agree using Word fields and styles makes a world of difference! I wish more users knew about them... Another gripe I have is that the UI (and sometimes keybindings) is quite different across platforms, and using Microsoft products on a Mac is ... disappointing. Plus as an old-school vim user I am partial to my keybindings. (Also, I would happily provide my LaTeX source, but I don't think my professor would appreciate that) – Possum Jun 23 at 18:01
4

Other answers already mentioned how, if the “Track changes” feature is enabled, it keeps tracks of what is being changed by an user, so it can be reviewed later. This is the intended use of the feature, so that others can view what changed when authoring/reviewing a document between different people.

I find unlikely that you would have that enabled unknowingly, but it can happen

This is implemented on purpose, and easily discoverable.

However, I should note that once upon a time, Microsoft Word had a "Quick save" feature that actually allowed that. It optimized saving times by actually appending the changes to the original document. It wasn't directly possible to browse them, but it was technically possible to recover an old version of the document. For this reason, it was recommended to disable this option before saving the final document. This option was removed ~10 years ago

| improve this answer | |
  • 1
    If we're doing "software archaeology" and you want to be really complete, from Word 97 to Word 2003 it was also possible to save several versions of the same document in a single .doc file, and switch between versions via the File->Version dialog. It was a conscious process to create such a version, except for a "save a version on close" option. And if someone else had been using versions on a document you were working on, you wouldn't necessarily know there was anything in the .doc except the version you were working on. Wonder how many secrets are still buried in files like that?! – yokki Jun 24 at 15:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.