.PPT File Format – Current User stream

PowerPoint 97–2003 presentation

The stream named Current User holds one record, a CurrentUserAtom. It says who last changed the file, whether it is encrypted, and where the newest user edit is in the PowerPoint Document stream. It is the starting point for reading a presentation.

CurrentUserAtom

  1. 0rh RecordHeader: recVer 0, recInstance 0, recType 0x0FF68 bytes
  2. 8size always 0x14, the size of the fixed part after the header4 bytes
  3. 12headerToken 0xE391C05F, or 0xF3D1C4DF if encrypted4 bytes
  4. 16offsetToCurrentEdit where the newest UserEditAtom is4 bytes
  5. 20lenUserName, docFileVersion 0x03F42 + 2 bytes
  6. 24majorVersion 3, minorVersion 0, unused1 + 1 + 2 bytes
  7. 28ansiUserName the name, in lenUserName bytesvariable
  8. relVersion 8, or 94 bytes
  9. unicodeUserName the name again, 2 × lenUserName bytes, optionalvariable
The CurrentUserAtom, the only record in the Current User stream.
FieldMeaning
headerToken0xE391C05F for a file that is not encrypted. 0xF3D1C4DF marks an encrypted file.
offsetToCurrentEditThe offset in the PowerPoint Document stream of the UserEditAtom of the newest edit.
lenUserNameThe length of ansiUserName in bytes, at most 255.
docFileVersionAlways 0x03F4.
majorVersion, minorVersionThe storage format version: 3.0.
ansiUserNameThe name of the last person to change the file.
relVersionThe release version of the format: 8, or 9 for more than one main master.
unicodeUserNameThe same name in UTF-16. When present it replaces the ANSI name. It can be left out.