A Word 97–2003 file is a Microsoft compound file, specified in [MS-CFB]. It is a small file system: a 512-byte header, then sectors of equal size chained into streams, and a directory that names them. All numbers are little-endian.
Header
0x00Signature D0 CF 11 E0 A1 B1 1A E180x08CLSID zero160x18Versions minor 0x3E, major 3 or 4, byte order FFFE60x1ESector shift 9 (512-byte sectors) or 12 (4,096); mini shift 640x2CFAT, directory, mini FAT and DIFAT counts and first sectors280x4CDIFAT the first 109 FAT sector numbers436
Sectors
After the header the file is sectors numbered from 0. Sector n starts at byte
(n + 1) × sector size. A sector number above 0xFFFFFFFA is a
special value: 0xFFFFFFFE ends a chain, 0xFFFFFFFF is free,
0xFFFFFFFD marks a FAT sector and 0xFFFFFFFC a DIFAT
sector.
FAT
The file allocation table has one 32-bit value for each sector: the next sector of the same chain, or one of the special values. The DIFAT lists the sectors the FAT itself is in: 109 in the header, the rest in DIFAT sectors chained after that.
DIFAT
Each DIFAT sector holds FAT sector numbers and, in its last entry, the number of the next DIFAT sector.
Directory
The directory is a chain of sectors holding 128-byte entries. Each entry names a stream or storage and gives its first sector and size.
| Offset | Size | Field |
|---|---|---|
0 | 64 | Name (UTF-16LE) |
64 | 2 | Name length in bytes, including the final zero |
66 | 1 | Type: 1 storage, 2 stream, 5 root |
67 | 1 | Colour of the entry in the name tree |
68 | 12 | Left, right and child entry numbers |
80 | 16 | CLSID. Word documents set the root’s to {00020906-0000-0000-C000-000000000046}. |
116 | 4 | First sector of a stream |
120 | 8 | Size of a stream in bytes |
Streams in a Word document
| Stream | What it holds |
|---|---|
WordDocument | The FIB at offset 0, the text, and the character and paragraph property pages |
1Table or 0Table | The piece table, styles, fonts, positions of notes, headers, fields, bookmarks and more. The FIB says which of the two is used. |
Data | Pictures (PICF headers and their images) and very long paragraph properties |
ObjectPool | A storage holding one storage for each embedded OLE object |
SummaryInformation | Title, author, dates and counts |
DocumentSummaryInformation | Category, company, manager and more |
Macros and others | VBA projects and optional parts, which this site does not describe |
The names of the two summary streams start with the character U+0005.
Mini stream
A stream under 4,096 bytes is kept in the mini stream, in 64-byte mini sectors. The mini stream itself is an ordinary chain of sectors that starts at the root entry’s first sector. The summary streams usually live here.
Mini FAT
The mini FAT chains mini sectors the way the FAT chains sectors.
Free sectors
A sector the FAT marks free is not part of the document now. A sector can still contain older data, so what is free or unreached in a file can be read in the file explorer.