0

So i wanted to make a quick small test on comparing hashes between a word document and a small modification inside the document and then revert the changes back to original and check all the 3 hashes. Of course the original and the modified document hash will be different but why is it that when i changed the document back to how it was originally ended up having a different hash when they have the same context?

  • 4
    Probably because the word document contains more than you can see, like for example the time of the last change. And this is included in the MD5 which just cares about the bytes and not the visible text. – Steffen Ullrich Feb 10 '17 at 22:14
  • @Steffen This makes it more clearer on this topic but will this be applied to other files too? or just specifically on different file formats – Legacy09 Feb 10 '17 at 22:18
  • This fully depends on the file format. Plain text files will usually be not affected (although they might be if spaces or line ending changed, i.e. invisible characters) but more complex formats like office might be. – Steffen Ullrich Feb 10 '17 at 22:19
  • Try to remove all meta tags from the word document and determine the md5. then do you change, revert it, save it and remove all the meta tags again. Check if those both hashes are the same – Tom Feb 11 '17 at 0:01
2

As others have pointed out in the comments, a Word document is more than just the visible text you see. Various bits of metadata (such as last modified time, or 'track changes' history) are stored within the file. If even one bit of one byte were changed, the hash would be completely different.

If you wish to find out which bits have changes, you can compare the original against the modified-then-changed-back copy with a tool like the unix "cmp" (compare files) command, which will tell you the byte location of the furst difference.

Or, break out your favorite hex editor to examine the bytes in each file, and you will find your non-visible change.

Also, as others pointed out, your case is particular to Word (and other meta-data-storing file formats). If you tried this experiment with a flat ascii text file, you would see the changed-back file have the same hash as the original.

1

As others have posted, Office/Adobe documents contain meta-data (as well as other document formats). You can attempt to scrub these but YMMV.

https://support.office.com/en-us/article/Remove-hidden-data-and-personal-information-by-inspecting-documents-356b7b5d-77af-44fe-a07f-9aa4d085966f

1

Your hash changed because the meta-information (e.g. date last modified) changed.

Word actually has a built-in feature that will generate a hash (and a digital signature) for you. It's called Insert Signature Line. While the primary purpose of this feature is to allow you to provide your signature, it also binds that signature to a digital hash of the contents so that you can prove if someone modified the document after you signed it.

You could also scrub out the meta-information in the Word doc by saving it in a plain format (e.g. UTF-8 text-only format). See this answer for someone else's answer on how to do this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.