A Word 6.0 or 95 document is a Microsoft compound file, specified in [MS-CFB]. It begins
with the signature D0 CF 11 E0 A1 B1 1A E1. The header (512 bytes) is
followed by sectors of 512 bytes chained into streams, and a directory names them.
Header
The header gives the sector size, where the FAT and directory start, and the first 109 FAT sector numbers.
Sectors
Sector n starts at byte (n + 1) × 512. Sector numbers above
0xFFFFFFFA are special: 0xFFFFFFFE ends a chain and
0xFFFFFFFF marks a free sector.
FAT and DIFAT
The file allocation table has a 32-bit value per sector: the next sector of the chain, or a special value. The DIFAT lists the FAT’s own sectors.
DIFAT sectors
When 109 FAT sectors are not enough, the header points to further DIFAT sectors.
Directory
128-byte entries name the storages and streams and give each stream’s first sector and size.
Streams
| Stream | What it holds |
|---|---|
WordDocument | The FIB, the text, formatting and the tables. Word 6.0 and 95 have no separate table stream. |
SummaryInformation, DocumentSummaryInformation | Title, author, dates and counts. The names begin with the character U+0005. |
ObjectPool | Embedded OLE objects |
Mini stream
Streams under 4,096 bytes are stored in 64-byte mini sectors inside the mini stream.
Mini FAT
A chain of 32-bit values, one per mini sector, like the FAT.
Free sectors
Sectors marked free are no longer part of the document but may still hold old data.