An .xlsx workbook (and its .xlsm / .xltx variants) is quietly self-documenting. Excel stamps the full folder path it was last saved into, the names of every worksheet and named range, and links to any other workbooks or databases it pulls from. None of that appears anywhere in Excel's interface, yet it travels with the file to whoever you send it to.
Scan a Excel fileThe headline finding is location. Excel writes the full folder a workbook was last saved into as a hidden absPath element - something like C:\Users\<name>\Desktop\ or a \\server\share UNC path - and never shows it anywhere in its interface. The tool flags it as the Saved Location, and reads the separate HyperlinkBase path too, so one workbook can name both the account that saved it and the network share it lived on.
Every worksheet name and every named range is listed. Names like 'SalaryBands' or 'CustomerList' describe the data even if the cells are hidden or filtered. Links to other workbooks (often \\server paths) and live external data connections to databases are surfaced as their own findings, because they map internal file shares and systems to anyone who receives the file.
Cell comments are read with their authors, naming whoever annotated the data. Password protection on the workbook or on individual worksheets is flagged - and it is protection, not encryption: the content stays fully readable and only editing is gated, while the password hash and salt sit in the file and can be attacked offline.
The standard author, last-modified-by and company fields, custom properties that may hold tracking IDs, a VBA macro project if present, and the created / modified / printed dates round out the scan. Images embedded in the sheets are also checked for their own EXIF and GPS.
This is a selection. The full field manual documents the fields read from each format.
The big one is the full folder path the workbook was last saved into - often C:\Users\<yourname>\ or a \\server\share - which Excel records invisibly and never displays. Add the author and company names, every sheet and named-range label, links to other workbooks and databases, and any cell-comment authors.
In a hidden absPath element inside the workbook XML. There is no dialog for it in Excel, so it survives being emailed on. A workbook can carry two absolute paths - this saved location and a separate HyperlinkBase - either of which can name your account or an internal server.
They can be. Named ranges like 'SalaryBands' or 'CustomerList' describe your data even when the cells are hidden, and external workbook links and data connections expose internal file-share paths and database systems to anyone who receives the file.
Scan it here to see exactly what's present, then save a stripped copy in your browser (no upload). In Excel, File > Info > Check for Issues > Inspect Document removes many properties, but re-scan afterwards to confirm the saved-location path and comments are gone.
File X-Ray reads Excel files entirely in your browser - the file never leaves your device. For this format you can also download a clean copy with the metadata removed. Scan a file now.