The pre-2007 Office formats - .doc, .xls, .ppt - and Outlook's saved .msg messages are all OLE Compound Files: a container of named streams that keeps more editing history than the modern .docx family. A binary Word or Excel file records the Windows account that last touched it and can hold a retained change log or a VBA macro project, while an Outlook .msg carries the full delivery trail of the email frozen inside it.
Scan a Legacy Office (DOC, XLS, PPT, MSG) fileA scan reads the two property-set streams every legacy Office file carries. That surfaces the Author recorded when the file was made and the Last Saved By name from the last save; when those are two different people the file is flagged as having changed hands. PowerPoint additionally records the Windows account of the last person to open the deck in a separate Current User stream that the Properties dialog never shows and that editing the properties does not clear. Company is the organisation the authoring copy of Office was registered to, and Manager, when the author filled it in, names a superior.
An Outlook .msg is a different beast entirely. It stores its correspondents as MAPI properties: the sender as a display name and address, and a recipient table listing everyone on the To, Cc and Bcc lines separately from the visible header. The internet headers inside carry the originating IP the message was sent from, the mail client that composed it, the Message-ID whose domain names the sending server, and a count of the mail servers that relayed it. The sender can also appear as an Exchange X.500 directory entry that spells out the internal organisation and mailbox path.
Legacy formats retain history that people assume is gone. Total Editing Time is the accumulated minutes the file was actually open (naive tools mis-render it as a date in 1601); the Revision Number counts saves; a shared-workbook Revision Log records who changed which cells; and a VBA macro project sits silently in the container, its code often full of author comments and paths. Hidden slides, embedded objects (each an entire document with its own author and dates), and a thumbnail preview of the first page all travel inside.
The quiet leaks live in the fields nobody edits. A Template stored as a full path exposes C:\Users\<name> or a network share. Custom document properties added by templates or document-management systems carry email addresses, client codes and internal names. Office's Send for Review feature writes the sender's email, display name and the message subject into the file and never removes them, so a review from years ago is still reconstructable from the document.
This is a selection. The full field manual documents the fields read from each format.
The binary Office formats store an Author and Last Saved By name, the Office application and version, created/saved/printed dates, the total minutes the file was edited, page and word counts, and any custom properties or template path. Because they predate .docx they also retain things like a VBA macro project, a shared-workbook revision log, hidden slides and embedded objects, each of which can carry its own author and history.
A .msg is the whole email saved to disk. It carries the sender's name and address, every recipient from its own To/Cc/Bcc table (including people removed from the visible header), the originating IP, the Message-ID whose domain names the sending server, the mail client used, the submit and delivery times, and often the sender's internal Exchange directory path. All of it stays with the file when it is forwarded or archived.
Outlook stores recipients in a structured recipient table that is separate from the visible To and Cc text. Editing the header line does not rewrite that table, so a scan reads each recipient - and the line they were on, including Bcc - directly from the message's own properties.
It can be. Author and Last Saved By name real people, a template or hyperlink-base path can expose a username or an internal server, custom properties often hold client codes or emails, and a macro project or embedded object can carry code and content you did not intend to send. A .msg additionally exposes the sender's IP and the full recipient list.
In Word, Excel or PowerPoint use File > Info > Check for Issues > Inspect Document, which removes document properties, comments, hidden text and personal information; re-saving as the modern .docx/.xlsx format first gives a cleaner result. For a .msg, the delivery headers and recipient table are intrinsic to the saved message. File X-Ray shows you exactly what is present so you know what to clear, but it inspects these formats rather than producing a stripped copy.
File X-Ray reads Legacy Office (DOC, XLS, PPT, MSG) files entirely in your browser - the file never leaves your device. For this format you can also download a clean copy with the metadata removed. Scan a file now.