Establishing Genealogies of Born Digital Content: The Suitability of Revision Identifier (RSID) Numbers in MS Word for Forensic Enquiry

Abstract

Born-digital content is rapidly becoming the norm for literary works, professional reports, academic journal articles, and formal corporate correspondence. From the perspective of digital forensics, there is a need to understand the origin of a document and its entire creation process, from outlining and drafting to editing the final version of the text. Revision save identifier (RSID) numbers embedded in MS Word documents have been used to examine the nature and extent of individual edits within a document. These RSIDs remain logged in the metadata even if the text with which they were associated has been removed. As copies of such files retain the original’s RSIDs, this metadata can be used to determine the order in which documents were cloned from each other. As a proof-of-concept, this paper examined over 400 template files generated by a single publisher for manuscript submissions to its journals. The study can show that it is possible to establish genealogies and thus relative chronologies of born digital content by first identifying those documents that share a document (root) RSID and then seriating those RSIDs that are shared between two or more documents.

1. Introduction

The personal computing and desktop publishing revolutions of the 1980s and 1990s, coupled with the rise to prominence of the WWW and associated e-mail communications in the late 1990s and early 2000s, have seen a fundamental shift in the generation of documents. The generation of textual material originates overwhelmingly in digital form, from outlining to writing and editing the final version of the text. This “born digital content” is poised to become the sole evidence for an author’s writing process for all written materials, be they literary works, professional reports, academic journal articles, or formal corporate correspondence. Akin to heavily edited typewritten manuscripts replete with strike-outs and manual marginal annotations, digital manuscripts can retain evidence of the editing processes of deletion, rephrasing, and addition. Unlike typewritten manuscripts, however, the evidence for these editing processes is not visible to the casual, everyday user.

Two aspects of digital manuscript files created by word processing programs are of interest from a forensic science and digital archeology perspective: their intentional manipulation for the purposes of hiding information (steganography) [1,2,3,4,5,6,7] and their use to identify content generation and editing processes that may shed light on the origin of the information contained in the files. The latter is of importance for understanding the nature, sequence, and extent of textual modifications in, say, policy documents. Importantly, in cases where multiple, iteratively generated versions exist, it might be useful to be able to reconstruct the overall editing sequence and thereby arrive at a ‘genealogy’ of the various documents.

Microsoft Word (henceforth MS Word), supplied as part of the Microsoft Office package of desktop applications and available for the main operating systems of Microsoft Windows and Apple Mac OS, has become one of the most ubiquitously used word processing programs and has attained a monopoly in the corporate, educational, and consumer space [8]. It is therefore useful to examine the suitability of MS Word files for digital forensics inquiries.

Using a large data set of MS Word document template files created by a single publisher, this paper provides a proof-of-concept demonstration to show that document genealogies can indeed be established using “revision save identifiers” (RISD) embedded in MS Word files—and that such genealogies are independent of metadata, such as time stamps, that can be easily manipulated.

1.1. Office Open XML Standard and the Implementation of Revision Save Identifier Numbers

From 2007 onwards, Microsoft implemented the Office Open XML standard [9], where all document components (text, styles, settings, metadata, etc.) are stored in a compressed archive, which is visible to the general user as a .docx file. In compliance with the standard, the application MS Word assigns a revision save identifier (rsid) number to each document (stored in the <rsidRoot> tag in the settings.xml file) and also to every document editing session that begins and ends with a save (or e-mail send) action. These RSID numbers are (i) embedded in a tag that encloses the respective text inserted during that editing session and (ii) stored in the settings.xml file as a sequence of eight-digit hexadecimal numbers. In the document XML file, each RSID is associated with a specific action such as a text insertion or deletion (if the track changes function was activated) as well as specific formatting such as bolding, the insertion of page and section breaks, and subsections of tables.

The Office Open XML standard requires that RSID numbers be “randomly generated based on the current time” and that “every editing session shall be assigned a revision save ID that is larger than all earlier ones in the same file” [9]. As noted elsewhere, MS Word does not faithfully implement the Office Open XML standard, and successive edits are not assigned RSID numbers of increasing value [10]. The Office Open XML standard also stipulates that “[a]n identical <rsid> value between two documents with the same <rsidRoot> shall indicate the same editing sessions” [9]. Thus, if a digital copy of a document is made, either by duplicating via the operating system (file copy) or via a “save as” action in MS Word, then both files will carry the same rootRSID and all other RSID listed in the respective settings XML files. The listed RSID numbers will start to diverge with the addition of new RSIDs, which reflect subsequent edit and save events that are unique to the duplicated files (Figure 1) [9]. Testing has shown that MS Word, both in its standalone desktop and distributed versions (Microsoft 365), does implement this part of the standard [10]. RootRSID numbers, as well as RSIDs assigned to an editing session, stay with a given document, even if this document is being shuttled around between multiple authors (with additional RSIDs allocated as editing progresses, irrespective of the computer used).

1.2. Using Revision Save Identifier Numbers to Develop Genealogies of Born-Digital Content

The adherence of MS Word to that part of the Office Open XML standard allows us to develop genealogies of document generation. The process of developing these genealogies is best explained through a hypothetical example, which shall be comprised of seven files (F1–F7), each of which contains eleven RSIDs. For the sake of simplicity, these were given alphanumeric identifiers in Figure 2. Each of these seven files contains RSIDs that are unique to that file and some that are shared between one or more other files. The removal of all RSIDs that are not shared between two or more of these files, followed by a seriation, results in the RSID pattern as shown in Figure 3.

In this example, three RSIDs (D, F, and I) are shared by all seven files, with two RSIDs shared by six files, three RSIDs shared by five files, one RSID shared by four files, and two RSIDs shared by two files each (Figure 3). Given that file F1 shares only three RSIDs with the other six files, and those files show other commonalities, F1 is the parent of the other six. Likewise, as F2 shares only five RSIDs with the other children of F1, files that also show other commonalities, F2 must be the parent of the remaining files. This logic allows us to develop a genealogy of files that can be represented in a phylogram (Figure 4). In the case of files F4 to F7, all have one additional RSID in common (RSID H), but differ, with files F4 and F5 sharing one RSID (T) that files F6 and F7 do not have, whereas files F6 and F7 possess a RSID (J) that is not shared with files F4 and F5. Thus, these four files all have a common ancestor, then split and split again. Genealogical priority cannot be resolved at the lowest level, however. While both F4 and F5 have a common direct ancestor, it is not clear whether F5 was split off from F4 or vice versa. A relative level of time depth can be established based on the number of shared RSIDs (representing the number of edits) between splits in the file sequence.

1.3. Aim of the Paper

Drawing on a large data set of MS Word document template files created for more than 400 journals published by a single publisher, this paper provides a proof-of-concept demonstration to show that document genealogies can in fact be established. At the conceptualization of the research, it had been posited that the overall ease of workflow and the time savings derived therefrom predicated that the overwhelming majority of the publisher’s journal template files would have been created by cloning and modifying one or more existing templates. The technique discussed in this paper will gain in importance as the need for the conservation, curation, and interpretation of ‘born digital’ content increases [11,12,13,14].

2. Methodology

2.1. Data Acquistion

By October 2022, the publisher Multidisciplinary Digital Publishing Institute (MDPI) (www.mdpi.com, accessed on 11 October 2022) had published 402 journal titles (see Appendix A for details). The publishing model requires authors to submit the manuscript in a close-to-publication-ready format, which entails the use of a journal-specific document template (Figure 5), which can be downloaded from the respective “Instructions for Authors” page. The document template file for each journal was individually downloaded. In addition, the Internet Wayback Machine (www.archive.org/web/, accessed on 10 February 2023) was used to acquire numerous archived copies of template files of several journals dating back to 2010, which covers the majority of journal titles (Figure 6).

2.2. Data Processing

All MS Word files, including MS Word templates (.dot), are compressed XML archives, which can be readily extracted by changing the file type from .dot to .zip.

Using a software tool written in Java, the RSID data (rootRSID and general RSIDs) were extracted from the settings.xml file (in the “word” subfolder) of each journal template file and written to a CSV data file. The same process was executed to extract the document creation and modification dates (file core.xml in the “docProps” subfolder). The RSID CSV file was sorted in MS Excel, with the RSID data for each template with the same root RSID subsequently extracted into separate work sheets for seriation. The seriated data were graphed to create a phylogram for several of the rootRSID.

3. Results

Given the effort involved in setting up a template file for a formal, print-ready manuscript, it was expected that the overwhelming majority of the journal template files would have been created by cloning and modifying a small number of existing templates. The assessment of the rootRSID of the template files for all 402 journal titles listed in the Appendix A, however, found that this was not the case: 212 (51.7%) of all titles carry unique rootRSIDs. Two rootRSIDs account for 29.1% of all template files, representing 62 titles (00D77B5F) and 52 titles (00996419) each. Both were mainly present in journals that began publication in 2020 and 2021. A small number of journals with older commencement dates (2012–2015 period) also have one of these two root RSIDs, which suggests that the templates for these journals were reworked at that time. A further three RSIDs are shared by more than 10 titles each, with another nine RSIDs being shared by two or more titles. Example proof-of-concept phylograms were established for six rootRSIDs (phylograms A–F, Figure 7, Figure 8, Figure 9, Figure 10, Figure 11 and Figure 12), which account for 42.3% of all journals.

Phylograms A and B reflect examples of successive creations and subsequent modifications of template files. The parent file of Phylogram A, based on root RSID 00A43C68, was created for the International Journal of Plant Biology, which in its creation and initial setup underwent 228 discrete edit and save actions. At that point, the file was duplicated for the journal Alloys (Figure 7). While the original file underwent another 74 edits until finalized, the template file for Alloys was edited six times before another duplicate for the file Dietetics was created. While Alloys was edited another 14 times until finalization, the template file for Dietetics was edited eight times before it was duplicated for the journals Waste, Meteorology, and Organoids (Figure 7). The template for Waste was edited three times before it spawned the template for the journal Entomology, while the template for Organoids became the parent for successive sequences of editing and spawning templates for other journals (Figure 7). Phylogram B, based on root RSID 007B3BA3, shows a similar linear sequence of generational editing and spawning from a single parent after an initial 175 discrete edit and save actions (Figure 8).

Phylogram C, based on root RSID 00A556C8, shows that the template for the journal Batteries spawned the template for the Journal of Cybersecurity and Privacy after 114 discrete edit and save actions. Both journal templates then went on to spawn subsequent linear sequences of generational editing and spawning (Figure 9).

Phylogram D, based on root RSID 00E13154, shows a very different workflow. The parent was the journal Thermo, which, after 117 discrete edits and save actions, spawned the template for the journal Acoustics (Figure 10). This template underwent 20 edit and save actions when it spawned the templates for the journals Psychem and Cardiogenetics. The template for the latter journal was edited twice and then formed the parent for the templates for 14 different journal titles. One of these spawned another, which in turn spawned two more. The 14 journals spawned from Cardiogenetics all underwent between 35 and 38 subsequent edit and save events.

Phylograms E and F are, in essence, merely more complex variations of the previous phylograms. Phylogram E, based on root RSID 00D77B5F and representing 62 titles, commenced as the template file for the Journal of Marine Science and Engineering, which, after 71 discrete edit and save actions, spawned Oceans, which, after five edit and save actions, spawned Psychiatry International (Figure 11). That journal template spawned two journals, one of which, Applied Mechanics, spawned another two journals, one of which was Reproductive Medicine. So far, the pattern follows that shown in Phylograms A–C. The template for Reproductive Medicine spawned the Journal of Zoological and Botanical Gardens and the journal Obesities. Each of these three journals was modified for four to six edit and save actions and then acted as the parent for numerous other journal templates, often created via file copies. Obesities acted as the parent for successive templates. All of these underwent considerable individual edits. Of these templates, the one for Earth is of interest because, after 68 discrete edit and save actions, this template spawned numerous other templates. Of significance is that, in that section of the genealogy of Phylogram E, the majority of templates are not spawned by large-scale copy file actions but by spawning following short runs of four to six edit and save actions.

Phylogram F, based on root RSID 00996419 and representing 52 titles, starts off as the template for Biomedinformatics, which after 111 discrete edit and save actions spawned templates for seven journal titles (Figure 12). One of these, Immuno, served as the parent for all other titles. What follows is a long sequence of a journal spawning a new template, which, following a short run of two to five edit and save actions, spawns a further new template. Two journals (Hygiene and Sexes) spawn two new titles each, which then spawn further templates and create their own descendant branches.

Theoretically, the time stamp data for document creation (dcterms:created) and modification dates (dcterms:modified) contained in the file core.xml (in the “docProps” subfolder) provide the time bracket between the initial creation of the file and the last save event. The document creation dates would therefore allow for an absolute measure of time for the relative file generation sequence established based on the seriation of the RSID numbers. The extracted document creation dates, however, show that the vast majority of template files (90.4%) were created within less than ten minutes of each other (

Table 1. File creation dates and times (GMT) as extracted from the core.xml file.

Time	n
2021-04-17 13:20:00	1
2021-12-27 04:45:00	15
2021-12-27 04:46:00	45
2021-12-27 04:47:00	45
2021-12-27 04:48:00	42
2021-12-27 04:49:00	44
2021-12-27 04:50:00	36
2021-12-27 04:51:00	39
2021-12-27 04:52:00	40
2021-12-27 04:53:00	41
2021-12-27 04:54:00	19
2021-12-28 00:43:00	15
2022-06-07 10:01:00	1
2022-06-07 10:03:00	5
2022-10-09 04:38:00	3
2022-10-09 04:39:00	4
2022-10-09 04:40:00	4
2022-10-09 04:41:00	4
2022-12-27 04:35:00	1
2022-12-27 04:38:00	1
Total	405

, 2021-12-27, 04:45 to 04:54 GMT) at an average of 41 files/minute. This can only have been achieved when a series of completed template files, created as .docx files, were opened and saved as.dot templates. This save action will preserve all RSID codes and allocations embedded in the document but will generate a file with a new creation date. This is reinforced by the observation that 94.3% of these files were never modified. Of the remaining 9.6% with creation dates other than 2021-12-27, 82.1% were never modified, suggesting that the low percentage of files that were modified were those where some elements were overlooked in the final QA process.

A small number of templates were finalized on 2022-10-09 between 04:38 and 04:41 (Table 1). Several of these belong to the end section of Phylogram E (Figure 13). While the relative chronology shows that the templates for the last five journals in the genealogy were successively cloned for the template for the journal Anatomia, adding the creation dates shows that Anatomia and the preceding journals were completed on 27 December 2021, while the templates for the new journals were added on 10 September 2022. At the same time, the template for the journal Receptors was also revisited and a new template saved. At the end of 2022, the template for the journal Analytics was revisited, and a new template was also saved.

The publication of the journals Future and Journal of Vascular Diseases started in 2022, while the journals Air, Arthropoda, and Targets formally commenced in 2023. Clearly, however, preparations for this had commenced long before.

Historic Trajectories of Selected Journals

In view of the findings that the majority of journals launched before 2021 tend to exhibit unique rootRSIDs but that a large number of journals launched in 2021 and 2022 used templates that had been created from a small number of rootRSIDs, it was decided to trace back the template files for a select number of journal titles. In order to be able to consider a longer historic trajectory, titles were chosen that had been founded in 2009 and 2010. The choice of journals was restricted by the availability of older versions of template files that had archived by the Wayback Machine. Overall, while most of the journals’ main landing pages as well as the “Instructions for Authors” pages were regularly archived, this did not extend to the linked download files. As a result, the availability of past templates was patchy (

Table 2. File format of template files 2010–2023 available for selected journals founded in 2009 and 2010.

	Journal
Year	Cancers	Diversity	Information	Micromachines	Nutrients	Remote Sensing	Sustainability	Water
2010						doc
2011						doc
2012	doc	doc		doc	doc	doc	doc
2013
2014	doc	doc				doc		doc
2015	doc	doc	doc	doc	doc docx [29 Sep]	doc	doc	doc
2016		docx	docx		docx	docx	docx	docx
2017		docx	docx		docx	docx	docx	docx
2018	doc	doc	doc	docx [15 Jan] doc [1 May]		doc	doc
2019
2020
2021	doc			docx		doc	doc [4 Feb] docx [27 Sep]	doc [18 Apr] docx [22 Jun]
2022	docx	docx	docx	docx	docx	docx	docx	docx
2023	docx	docx	docx	docx	docx	docx	docx	docx

).

The early template files of the 2010 to 2015 period were based on the .doc format. This makes sense from a publisher’s perspective, as the public adoption of the .docx format of files based on the Office Open XML standard, as introduced by Microsoft in 2007, was slow, and the publisher had to ensure compatibility. From late 2015 on, templates used the XML-based file format. Intriguingly, this format seems to have been abandoned during the second quarter of 2018 with the reintroduction of the .doc format. While there are no archived template files for any of the eight chosen journals for the years 2019 and 2020, template files created for other journals (as retrieved via the Wayback Machine) show that the .doc format was used both in 2019 (Heritage) and 2020 (Nanomaterials). The rationale for the temporary switchback to .doc format templates remains unclear. Template files changed back to the XML based format during the second quarter of 2021 (Table 2, date supported by other journal titles).

An examination of the documents’ XML files for the eight journals (

Table 3. Root RSID, total number of RSIDs listed in the RSID table, and file creation and modification dates (in italics) of the XML files of selected journals founded in 2009 and 2010.

	Journal
Year	Cancers	Diversity	Information	Micromachines	Nutrients	Remote Sensing	Sustainability	Water
2015					00486F32 [1345] 2015-09-29
2016		005835BC [1413] 2016-01-21	006B0BD2 [1414] 2016-01-21		00ED1887 [1372] 2016-05-03	001D1B57 [1396] 2016-01-21	001F4825 [1396] 2016-01-21	00F2211C [1420] 2016-05-03 2016-11-04
2017		00740F17 [1432] 2017-01-11	0048362C [1446] 2016-05-03 2017-06-06		00ED1887 [1406] 2016-05-03 2017-09-13	005D4A69 [1431] 2016-05-03 2017-06-06	00E477C2 [1429] 2016-05-03 2017-06-06	00F2211C [1442] 2016-05-03 2017-06-06
2018				00A657BD [1418] 2018-01-08
Hiatus
2021				00AE0E56 [155] 2021-07-23			00CD3203 [153] 2021-07-23	00746129 [153] 2021-04-17
2022	003A55A8 [195] 2022-06-07	007B1618 [171] 2022-06-07	004E6907 [172] 2021-12-27	00AE0E56 [170] 2022-06-07	002549C8 [166] 2021-12-27	0014356F [172] 2022-06-07	00CD3203 [167] 2021-12-27 2022-01-07	00746129 [170] 2022-06-07
2023	003A55A8 [207] 2022-06-07	007B1618 [184] 2022-12-27	004E6907 [187] 2022-12-27	00AE0E56 [182] 2022-12-27	002549C8 [182] 2022-12-27	0014356F [184] 2022-12-27	00CD3203 [182] 2022-12-27	00746129 [182] 2022-12-27

) showed that the template files before and after the 2018–2021 return to the .doc file format differ significantly. The files from 2021 onwards all have in common that the rootRSID for each title remains the same for the 2021, 2022, and 2023 templates and that the total number of RSIDs listed in the templates increases each year. Clearly, the 2022 XML-based template for a journal was developed by cloning and editing the 2021 journal template, while the 2023 XML based template was developed by cloning and editing the 2022 template. This conforms with the expectations for document genealogies as discussed above.

All XML-based template files offered in 2016, 2017, and 2018, however, carry different rootRSIDs for each year (except for the journal Nutrients) and exhibit significantly larger numbers of RSIDs (average 1416 RSIDs) than the templates from the 2021–2023 period (average 172 RSIDs). Looking at the file creation dates, numerous files were created on the same date (2016-05-03), suggesting the same QA processes were at work in 2016 as they were in 2022.

4. Discussion

The foregoing section has shown that the combination of rootRSIDs and general RSIDs contained in MS Word XML files can be used for seriation and that phylograms can be derived that represent document genealogies and relative chronological sequences. The phylograms clearly demonstrated whether templates were generated by copying an existing template file several times (e.g., Phylogram D, Figure 10), or whether creation sequences were largely iterative, with new templates spawned following minor edits (e.g., Phylogram F, Figure 12).

Theoretically, the extraction of file creation dates would allow us to place these relative chronological sequences on an absolute time scale, with the caveat (from a digital forensics perspective) that file creation dates can be manipulated. A relative chronological sequence could not be demonstrated for the present case study as 90.4% of all template files were created within less than ten minutes of each other. While the bulk of the data was not suitable for establishing absolute chronologies, it provided an insight into the production process. The data suggests that the individual template files had been cloned, modified, and completed after passing quality assurance. These finalized files were then saved from .docx to the .dot format for use as templates, with the majority of these not undergoing a single further edit. Under “normal” document generation circumstances, such actions would be extremely rare, and absolute chronologies could be developed. The end section of Phylogram E (Figure 13) can serve to support the proof of concept.

The file creation date stamps have limitations, however, as the dcterms:created and dcterms:modified tags of MS Word record the computer time only in full minutes. Thus, they do not allow us to distinguish between a file copy using the operating system (and subsequent renaming), which would have a time stamp that is identical to the original to the second, and a copy made via a “save as” action, which would be likely to deviate by one or more seconds, assuming that the “save as” action occurs immediately after the final save of the parent file. If, however, sufficient time (for the computer clock to move to the next full minute) is allowed to elapse while the parent file is still open, or if that amount of time elapses between the last save (and close) of the parent file and the ‘save as’ action of the reopened parent file, then the time stamps of the parent and the child files will diverge (verified by testing). The modification date stamp would indicate the time spent modifying the relevant child document.

Since the file data are coded to Z(ulu) time (i.e., GMT), global time zone differences can be ignored, a matter that would come into play when considering documents derived from international collaboration or contract cheating drawing on international tutors.

While the MS Word XML also allows for the document’s creator to be identified via the <dc:creator> tag in the core.xml file, all creator IDs were, as expected, set to the corporate MDPI term. Consequently, individual editors cannot be identified from the metadata. Even though it is not possible to assess how many people worked on the creation of the templates represented by Phylograms A–C and attribute the changes to specific authors, the unique pattern of Phylogram D suggests, albeit not conclusively, that the same author duplicated the template for the journal Cardiogenetics before editing them one-by-one.

5. Conclusions

Since 2007, Microsoft has implemented the Office Open XML standard in its suite of desktop applications. Given the near monopoly held by MS Word in the corporate, educational, and consumer spaces, this provides opportunities for digital forensics. From a document forensics perspective, the allocation of revision save identifiers (RSIDs) to reflect a range of textual and formatting edits allows us to understand much of the generation, writing, and editing history of a MS Word document.

As this paper has demonstrated, the allocation of a unique document RSID (rootRSID) to each MS Word file, which persists even when that file is duplicated via “save as” events or via direct file copy in the operating system, forms the basis for document genealogies. Starting with common “ancestor” document content, and thereby the RSID associated with the new content, they will begin to diverge. Subsequent copying will spawn new generations with shared but diverging combinations of RSIDs. A seriation of the shared RSIDs contained in the XML metadata of MS Word files can be used to develop phylograms, which represent the relative genealogical relationship between documents created from the same ancestor file. Differences in document creation dates then allow this relative relationship to be translated into absolute chronological dimensions.

An examination of over 400 template files produced by the publisher MDPI, carried out as a proof-of-concept exercise, validated the theoretical model. Moreover, several of the phylograms, combined with document creation timestamp information, also provided insights into the publishers’ template production processes, underscoring the potential of RSIDs for digital forensic inquiry.

The findings of this proof-of-concept exercise have wide-ranging implications. The unique allocation of document RSIDs, coupled with the sequential addition of RSIDs associated with new content, allows for the generation of parent-child relationships between documents. Importantly, these genealogies are methodologically independent of other metadata, in particular time stamps, that are easily manipulated. Where multiple versions exist that exhibit conflicting text, the establishment of document genealogies allows an investigator to understand from which document the deviating file was forked.

Positioning genealogically one file between two others, where the creation dates of all files are known, may confirm or contradict the metadata embedded in the file, thereby potentially highlighting willful manipulation of dates.

Finally, from a future historian’s point of view, the ability to establish genealogies of iteratively generated “draft” documents will give insight into policy development and formulation processes, akin to interpreting the strike-outs and file annotations encountered in traditional paper-based archival documents.