Case:
A customer’s account report cannot be opened the next day under normal modification.
Solution:
The Winhex analysis found that the file was 4KB. After the positioning, it was found that it was only one file header. It seemed that it might be offset.XLS is a classic application of MS composite documents. In XLS, a flat management method is used, and the global sheet stream is used to manage each sheet stream.Under normal circumstances, if the global SHEET stream is not successfully recovered, it is messy even if there are various sheet stream data.Position the fragments by directly analyzing the global sheet method, and the two composite conditions are quickly obtained through multiple conditions search. After the analysis table content is the same, the one with the largest offset value is found.After the positioning of the 8 sheet table, continue to analyze the fragments, and obtain the SAT’s relative offset value from the SAT table given in the file header to the fragment.Extracted and reorganized, and the document recovered successfully.