WO2004001591A2

WO2004001591A2 - System and method for identifying, classifying, extracting, and resolving hidden entities

Info

Publication number: WO2004001591A2
Application number: PCT/US2003/019002
Authority: WO
Inventors: Gregory L. Smith
Original assignee: The Boeing Company
Priority date: 2002-06-20
Filing date: 2003-06-12
Publication date: 2003-12-31
Also published as: EP1514177A2; US7398465B2; AU2003278358A1; WO2004001591A3; US20040205601A1; AU2003278358A8

Abstract

A method for identifying, classifying, extracting and resolving hidden entities from a data file includes searching for an executing copy of an application associated with the data file, initiating the application in a background if the application is not running, opening the data file for reading only, examining the data file for hidden entities, generating an examination log of incidents of hidden entities, and optionally, resolving the incidents of hidden entities.

Description

SYSTEM AND METHOD FOR IDENTIFYING, CLASSIFYING, EXTRACTING AND RESOLVING HIDDEN ENTITIES

BACKGROUND OF THE INVENTION

[001] The present invention generally relates to software applications and, more particularly, to a software application for identifying, classifying, and extracting hidden or embedded entities in a data file. [002] As is well known in the art, it is possible to hide or embed data in documents of various types. For example, U.S. Patent No. 5,822,436 discloses a machine-readable marking provided on emulsion films, photographic papers, and the like. The marking encodes digital information, yet is essentially imperceptible to the human eye. Additionally, U.S. Patent No. 6,289,108 discloses providing a photograph with supplemental data. This supplemental data is below a threshold of human perception (e.g., is essentially invisible) yet can extend throughout the image.

[003] Furthermore, during the preparation of data files, data may be hidden in such files, whether deliberately or inadvertently. Hidden data includes data within an application or an application data file that may not be visible by normal viewing of the data within the application. For example, during the preparation of a PowerPoint® presentation, text may be included in a slide where the color of the font matches the fill color of the text box. [004] Such hidden data raises security concerns should the data file reach an audience other than an intended audience. This is particularly so in the case of proprietary or classified information hidden in data files.

[005] As can be seen, there is a need for a system and method for identifying, classifying, and extracting hidden information from data files. Such a system and method preferably includes a means for resolving hidden information issues identified. SUMMARY OF THE INVENTION

[006] In one aspect of the present invention, a method for identifying, classifying, extracting, and resolving hidden entities from a data file includes searching for an executing copy of an application associated with the data file; initiating the application in a background if the application is not running; opening the data file for reading only, examining the data file for hidden entities; and generating an examination log of incidents of hidden entities. The method may include resolving the incidents of hidden entities.

[007] In another aspect of the present invention, a method for identifying, classifying extracting and resolving hidden entities from a data file includes searching for an executing copy of an application associated with the data file, initiating the application in a background if the application is not running, opening the data file for reading only, examining the data file for hidden entities including non visible shapes, picture font text, alternative text, hidden slides, hyperlinks, objects, text font, color and size, background color matches, overlapping shapes, off slide shapes, off slide text, slide comments, slide notes, slide scripts, slide media, slide pictures, and macros, and generating an examination log of incidents of hidden entities. The method may include resolving the incidents of hidden entities.

[008] In yet another aspect of the present invention, a system for identifying, classifying, extracting hidden entities from a data file includes a memory coupled to a processor, the processor operable to search for an executing copy of an application associated with the data file, initiate the application in a background if the application is not running, open the data file for reading only, examine the data file for hidden entities, generate an examination log of incidents of hidden entities. The processor may be operable to resolve the incidents of hidden entities. [009] In a further aspect of the present invention, a computer readable media for identifying, classifying, extracting and resolving hidden entities from a data file includes a code segment for searching for an executing copy of an

~> application associated with the data file, a code segment for initiating the application in a background if the application is not running, a code segment for opening the data file for reading only, a code segment for examining the data file for hidden entities, and a code segment for generating an examination log of incidents of hidden entities. The computer readable media may include a code segment for resolving the incidents of hidden entities. [0010] These and other features, aspects and advantages of the present invention will become better understood with reference to the following drawings, description and claims.

BRIEF DESCRIPTION OF THE DRAWINGS

[0011] FIG. 1 is a schematic representation of a prior art computer system;

[0012] FIG. 2 is a screen shot of a user interface in accordance with the invention; [0013] FIG. 3 is a screen shot of an options window in accordance with the invention;

[0014] FIG. 4 is a pseudocode listing illustrating a routine in accordance with the invention;

[0015] FIG. 5 is a screen shot of an examination log in accordance with the invention;

[0016] FIG. 6 is a pseudocode listing illustrating a routine in accordance with the invention;

[0017] FIG. 7 is a pseudocode listing illustrating a routine in accordance with the invention; [0018] FIG. 8 is a pseudocode listing illustrating a routine in accordance with the invention;

[0019] FIG. 9 is a screen shot of an examination log in accordance with the invention; [0020] FIG. 10 is a pseudocode listing illustrating a routine in accordance with the invention;

[0021] FIG. 11 is a pseudocode listing illustrating a routine in accordance with the invention;

[0022] FIG. 12 is a screen shot of an examination log in accordance with the invention;

[0023] FIGS. 13a and 13b are a pseudocode listing illustrating a routine in accordance with the invention;

[0024] FIG. 14 is a screen shot of an examination log in accordance with the invention; [0025] FIGS. 15a, 15b, and 15c are a pseudocode listing illustrating a routine in accordance with the invention;

[0026] FIG. 16 is a screen shot of an examination log in accordance with the invention;

[0027] FIGS. 17a, 17b, and 17c are a pseudocode listing illustrating a routine in accordance with the invention;

[0028] FIG. 18 is a screen shot of an examination log in accordance with the invention;

[0029] FIGS. 19a, 19b, and 19c are a pseudocode listing illustrating a routine in accordance with the invention; [0030] FIG. 20 is a screen shot of an examination log in accordance with the invention;

[0031] FIGS. 21a, 21 b, and 21c are a pseudocode listing illustrating a routine in accordance with the invention;

[0032] FIG. 22 is a screen shot of an examination log in accordance with the invention; [0033] FIG. 23 is a pseudocode listing illustrating a routine in accordance with the invention;

[0034] FIG. 24 is a screen shot of an examination log in accordance with the invention; [0035] FIG. 25 is a pseudocode listing illustrating a routine in accordance with the invention;

[0036] FIG. 26 is a screen shot of an examination log in accordance with the invention;

[0037] FIGS. 27a and 27b are a pseudocode listing illustrating a routine in accordance with the invention;

[0038] FIG. 28 is a screen shot of an examination log in accordance with the invention;

[0039] FIGS. 29a and 29b are a pseudocode listing illustrating a routine in accordance with the invention; [0040] FIG. 30 is a screen shot of an examination log in accordance with the invention;

[0041] FIGS. 31a, 31 b, and 31c are a pseudocode listing illustrating a routine in accordance with the invention;

[0042] FIG. 32 is a screen shot of an examination log in accordance with the invention;

[0043] FIGS. 33a and 33b are a pseudocode listing illustrating a routine in accordance with the invention;

[0044] FIG. 34 is a screen shot of an examination log in accordance with the invention; [0045] FIGS. 35a and 35b are a pseudocode listing illustrating a routine in accordance with the invention;

[0046] FIG. 36 is a screen shot of an examination log in accordance with the invention;

[0047] FIG. 37 is a pseudocode listing illustrating a routine in accordance with the invention; [0048] FIG. 38 is a screen shot of an examination log in accordance with the invention;

[0049] FIG. 39 is a pseudocode listing illustrating a routine in accordance with the invention; [0050] FIG. 40 is a screen shot of an examination log in accordance with the invention;

[0051] FIG 41 is a pseudocode listing illustrating a routine in accordance with the invention;

[0052] FIG. 41a is a screen shot of an examination log in accordance with the invention;

[0053] FIGS. 42a and 42b are a pseudocode listing illustrating a routine in accordance with the invention;

[0054] FIG. 43 is a screen shot of an examination log in accordance with the invention; [0055] FIGS. 44a and 44b are a pseudocode listing illustrating a routine in accordance with the invention;

[0056] FIG. 45 is a screen shot of an examination log in accordance with the invention;

[0057] FIGS. 46a and 46b are a pseudocode listing illustrating a routine in accordance with the invention;

[0058] FIG. 47 is a screen shot of an examination log in accordance with the invention;

[0059] FIGS. 48a and 48b are a pseudocode listing illustrating a routine in accordance with the invention [0060] FIGS. 49a and 49b are a pseudocode listing illustrating a routine in accordance with the invention;

[0061] FIG. 50 is a screen shot of a report in accordance with the invention; and

[0062] FIG. 51 is a screen shot of a user interface in accordance with the invention. DETAILED DESCRIPTION OF THE INVENTION

[0063] The following detailed description is of the best currently contemplated modes of carrying out the invention. The description is not to be taken in a limiting sense, but is made merely for the purpose of illustrating the general principles of the invention, since the scope of the invention is best defined by the appended claims. [0064] The present invention generally provides a method for identifying, classifying and extracting hidden entities from a data file. The method includes searching for an executing copy of an application associated with the data file, initiating the application in a background if the application is not running, opening the data file for reading only, examining the data file for hidden entities, generating an examination log of incidents of hidden entities, and optionally, resolving the identified incidents. In contrast to the prior art, the present invention does not provide for hidden or embedded data but rather provides a means by which such data may be identified, classified, extracted and resolved. [0065] The present invention finds broad applicability in the field of business where data files are shared among many different users and across multiple disciplines. Hidden data in such files raises security concerns should the data file reach an audience other than an intended audience. This is particularly so in the case of proprietary or classified information hidden in data files. The present invention resolves these concerns by identifying, classifying, extracting and, at the user request, removes or transforms such hidden data. [0066] One embodiment of the present invention includes computer software executing within a computer system. FIG. 1 shows an exemplary computer system generally designated 100. The computer system 100 may include one or more processors, such as processor 104 connected to a bus 106. [0067] The computer system 100 also may include a main memory 108, preferably random access memory (RAM), and a secondary memory 110. The secondary memory 110 may include a hard disk drive 112 and a removable storage device 114, such as a floppy disk drive, a magnetic tape drive, and a compact disk drive. The removable storage drive 114 reads from and writes to a removable storage unit 116 in a manner well known in the art.

[0068] Removable storage unit 116, also called a program storage device or a computer program product, represents computer readable media which may include a floppy disk, magnet tape, and a compact disk. The removable storage unit 116 may include a computer usable storage medium having therein stored computer software and/or data.

[0069] Computer programs (also called computer control logic) may be stored in main memory 108 and/or secondary memory 110. Such computer programs, when executed, enable the computer system 100 to perform the functions of the present invention as further described herein. In particular, the computer programs, when executed, enable the processor 104 to perform the functions of the present invention. Accordingly, such computer programs represent controllers of the computer system 100.

[0070] Alternative embodiments of the present invention are directed to a computer program product comprising a computer readable medium having code segments (computer software or control logic) stored therein. The code segments, when executed by the processor 104, causes the processor 104 to perform the functions as further described herein.

[0071] Further embodiments of the present invention are implemented primarily in hardware using, for example, a hardware state machine (not shown). Implementation of the hardware state machine so as to perform the functions described herein will be apparent to persons skilled in the relevant arts.

[0072] In a preferred embodiment of the invention, a computer software application may search for an executing copy of an application associated with a data file to be examined. If the application is not running, the application may be initiated in the background. The data file may then be opened for reading only within the application running in the background. The software application next may examine the data file for hidden entities as further described herein. An examination log may be generated whereby incidences of hidden entities are recorded in the examination log including major and minor warning messages. The examination may be displayed in a user interface. When warning messages are selected by a user, the application containing the hidden entities may be brought to the foreground. [0073] The examination log may be divided into a plurality of sections.

Each section documents data hiding findings resulting from the execution of particular data hiding identification algorithms as further described herein. High level progress information including for example sheet number, page number, or slide number being examined may be displayed in the examination log when the examination is executed. In addition, low-level progress information including for example cell, paragraph, shape, or other specific entity being examined may be displayed in a status bar at a bottom of an application user interface. When a data hiding incident is located within the data file, a warning message may be displayed in the examination log. [0074] Major warning messages may be displayed which describe a possible data hiding incident and include a location of the data and a specific shape involved such as slide number or master name, for example. Minor warning messages may be displayed which do not include the location of the data. [0075] Identified hidden data incidents can be resolved at the request of the user by removal, repair, or inclusion in a visible area. All of these options are available to the user at resolution initiation or as incidents are identified. [0076] One embodiment of the present invention will be described with particular reference to Microsoft PowerPoint®, a presentation application distributed by Microsoft Corporation of Redmond, WA. Those skilled in the art will recognize that the systems and method of the present invention are equally applicable to any data file capable of having data hidden therein. [0077] In PowerPoint® presentations, the majority of information is defined on presentation slides. However, PowerPoint® also supports the concept of master slides. A master slide defines formatting for all slides or pages in the presentation. Each presentation has a master slide for each component, that is, a slide master for each slide, a title master for each title, a notes master for speaker's notes, and an audience handout master for audience handouts. PowerPoint® utilizes shapes to store the majority of information that is placed on the slides, notes and masters.

[0078] With reference to FIG. 2, a user interface 200 is shown including pull-down menus 210 and toolbar buttons or icons 220 as well known in the art. Also shown is a status bar 230. The software application of the present invention is a point-and-click based application preferably running on a Windows® (a registered trademark of Microsoft Corporation, Redmond, WA) operating system.

[0079] With reference to FIG. 3, an options window 300 is shown including a plurality of examination features 310. Examination features 310 relate to the examination of a PowerPoint® presentation and include a plurality of reports 320 reported in the examination log as further described herein.

[0080] An exemplary routine of the present invention is illustrated in FIG.

4 and includes a routine "ExaminePPT/ResolvePPT" 400 for examining a PowerPoint® presentation for hidden entities in accordance with the present invention. In a step 401 , in process setup is performed. Next, in a step 402, a PowerPoint® header is written and, in a step 403, a slide list is set up. In a step 404, a presentation header is written and, in a step 405, the presentation is ungrouped. Each selected examination feature is then run in a step 406 including a status bar 230 in update step 407. Finally, in steps 408, 409, and 410 a completion header is written, a summary is written, and in process cleanup is performed. [0081] An exemplary examination log 500 is shown in FIG. 5 including a

Report General File Information 510, the purpose of which will be further described with reference to FIG. 6. Documentation of a sequence 520 of the examination process is also shown. [0082] In accordance with an aspect of the invention and with reference to FIG. 6, a routine "ReportFilelnformation" 600 is shown including a plurality of write steps 601 which may generate the Report General File Information 510. [0083] In accordance with another aspect of the invention, a routine

"ReportPPTApplnformation" 700 is shown in FIG. 7 and includes a plurality of write steps 701 for reporting specific information regarding the particular application associated with the data file being examined. Such information may aid a software developer in determining if a reported warning is version dependent, for example. [0084] PowerPoint® supports the definition of high-level presentation properties such as presentation name, path, template, and masters defined, for example. In addition, built-in and custom properties can be defined. Each property includes a property name and a property value. The property values are not visible within the presentation, and as such, data can be inadvertently hidden in the property values. [0085] In accordance with yet another aspect of the invention, a routine

"ReportPPTPreslnformation" 800 is shown in FIG. 8 including a plurality of write steps 801 for identifying the data file being examined. A routine 802 may include a step 803 for determining if each tag has a value. If the tag has value, in a step 804, a tag string length is compared to a user setting and if the tag string length is greater than the user setting, a data hiding incident is reported in a step 805.

[0086] A routine 810 may include a step 811 for determining if a built-in property has a value. If the built-in property has value, in a step 812, a built-in property string length is compared to a user setting and if the built-in property string length is greater than the user setting, a data hiding incident is reported in a step 813.

[0087] A routine 820 may include a step 821 for determining if a custom property has a value. If the custom property has a value, in a step 822, a custom property string length is compared to a user setting. If the custom property string length is greater than the user setting, a data hiding incident is reported in a step 823.

[0088] An exemplary examination log 900 including a major warning 901 indicating a built-in property string length greater than the user setting is shown in FIG. 9.

[0089] With reference to FIG. 10 and in accordance with another aspect of the invention, a routine "ReportPPTMasters" 1000 may include a plurality of write steps 1010 for generating a report listing which masters are defined in the presentation being examined. [0090] PowerPoint® maintains an internal list of all fonts used in a presentation. In accordance with an aspect of the invention a routine "ReportPPTFonts" 1100 may include a step 1110 for reporting an unknown font and a step 1120 for reporting a picture font as shown in FIG. 11. An exemplary examination log 1200 including a plurality of minor warnings 1210 is shown in FIG. 12.

[0091] In PowerPoint®, shapes contain the majority of text, pictures, links, and objects. Each shape has a visibility attribute that can be set programmatically or via a macro. A shape whose visibility attribute is set becomes non-visible to those viewing the presentation. As such, these shapes can hide data. Non-visible shapes can be placed on slides, note pages, the note master, the slide master, the title master, and the handout master. [0092] A routine "ReportPPTShapeVisiblity" 1300 in accordance with an aspect of the invention may include a step 1310 for examining each shape on a slide master, a step 1320 for examining each shape on a title master, a step 1325 for examining each shape on a notes master, a step 1330 for examining each shape on a handout master, and a step 1340 for examining each shape on each slide and associated slide notes as shown in FIGS. 13a and 13b. In a step 1350, each shape that is determined to not be visible in steps 1310 through 1340 is examined and in a step 1351 the text is obtained. In a step 1360, a determination is made whether resolution of the not visible shape is in process. If resolution is in process, in a step 1361 the shape is made visible, resolution is reported in a step 1362, and the shape text is written in a step 1363. If resolution is not in process, then in a step 1370 a data hiding incident is reported and the shape text is written. An exemplary examination log 1400 is shown in FIG. 14 including a plurality of major warnings 1410.

[0093] Picture fonts are defined in PowerPoint® as those fonts whose characters are depicted by pictures. Data can be hidden when picture fonts are used as a viewer cannot visually understand the information being portrayed by the text. In addition, text may contain mixed fonts. Picture fonts can be defined on shapes and placed on slides, notes pages, the notes master, the slide master, the title master, and the handout master.

[0094] In accordance with an aspect of the invention a routine

"ReportPPTPictureFontText" 1500 may include a step 1510 for examining a shape picture font for each shape on a slide master, a step 1520 for examining a shape picture font for each shape on a title master, a step 1530 for examining a shape picture font for each shape on a notes master, a step 1540 for examining a shape picture font for each shape on a handout master, and a step 1550 for examining each shape picture font on each slide and associated slide notes as shown in FIGS. 15a, 15b, and 15c. In a step 1560 each shape identified in steps 1510 through 1550 as having a shape picture font may be examined. Based on shape type, either a text frame or text effect may be determined. In steps 1570 and 1580, text fonts that are picture fonts and text effect fonts that are picture fonts are reported. An exemplary examination log 1600 is shown in FIG. 16 including a plurality of major warnings 1610. [0095] Data can be hidden in data files in fonts that are too small or too large to be read. Very small text can be misinterpreted as lines. Very large text can be misinterpreted as shapes and/or the slide background. Small fonts may be defined as those fonts whose size is less than 5 points. Large fonts may be defined as those fonts whose size is greater than 100 points. Large and small fonts can be defined on text, within a shape, and placed on or off slides, notes pages, the notes master, the slide master, the title master, and the handout master. [0096] A routine "ReportPPTFontSize" 1700 in accordance with an aspect of the invention may include a step 1710 for examining a shape font size for each shape on a slide master, a step 1720 for examining a shape font size for each shape on a title master, a step 1730 for examining a shape font size for each shape on a notes master, a step 1740 for examining a shape font size for each shape on a handout master, and a step 1750 for examining a shape font size on each slide and associated slide notes as shown in FIGS. 17a, 17b, and 17c. In a step 1760 each shape identified in steps 1710 through 1750 as having a shape font size may be examined. Based on shape type, either a text frame or text effect may be determined. In steps 1770 and 1780, text font sizes that are greater than or less than a user setting and text effect font sizes that are greater than or less than a user setting are reported. In addition, text that contains mixed font sizes is examined character by character and warnings are issued when user settings are exceeded. An exemplary examination log 1800 is shown in FIG. 18 including a plurality of major warnings 1810. [0097] Data can be hidden in data files in shapes that are too small or too large to be interpreted. Very small shapes can be misinterpreted as lines. Very large shapes can cover other shapes, possibly hiding data. Small shapes may be defined as those shapes whose size is less than 18 points. Large shapes may be defined as those shapes whose size is greater than 1000 points. Large and small shapes can be placed on or off slides, notes pages, the notes master, the slide master, the title master, and the handout master. [0098] In accordance with an aspect of the invention a routine

"ReportPPTShapeSize" 1900 may include a step 1910 for examining a shape size for each shape on a slide master, a step 1920 for examining a shape size for each shape on a title master, a step 1930 for examining a shape size for each shape on a notes master, a step 1940 for examining a shape size for each shape on a handout master, and a step 1950 for examining a shape size on each slide and associated slide notes as shown in FIGS. 19a, 19b, and 19c. In a step 1960 each shape identified in steps 1910 through 1950 as having a shape font size may be examined. Based on shape type, either a text frame or text effect may be determined. In steps 1970 and 1980, shape widths that are less than a user setting and shape widths and heights that are greater than a user setting are reported. An exemplary examination log 2000 is shown in FIG. 18 including a plurality of major warnings 2010. [0099] Alternative text can be defined on various shapes. Web browsers display alternative text while pictures are loading or if they are missing. Web search engines use alternative text to help find web pages. As alternative text is not visible unless every shape in a presentation is examined, the present invention generates warnings when alternative text is located that does not match the text of the shape. Alternative text can be defined on shapes and placed on or off slides, notes pages, the notes master, the slide master, the title master, and the handout master.

[00100] A routine "ReportPPTAIternativeText" 2100 in accordance with an aspect of the invention may include a step 2110 for examining a shape alternative text for each shape on a slide master, a step 2120 for examining a shape alternative text for each shape on a title master, a step 2130 for examining a shape alternative text for each shape on a notes master, a step 2140 for examining a shape alternative text for each shape on a handout master, and a step 2150 for examining a shape alternative text on each slide and associated slide notes as shown in FIGS. 21a, 21 b, and 21c. In a step 2160 each shape identified in steps 2110 through 2150 as having a shape alternative text may be examined. Based on shape type, either a text frame or text effect may be determined. In a step 2170, a data hiding incident is reported if text exists and it is not equal to the alternative text, or, if text does not exist, alternative text exists. In a step 2180, a data hiding incident is reported if effect text exists and it is not equal to the alternative text, or, if effect text does not exist, alternative text exists. An exemplary examination log 2200 is shown in FIG. 18 including a plurality of major warnings 2210.

[00101] Hidden slides are those slides that have been hidden from the slide show. When a presentation is viewed in the slide show mode, these hidden slides are not visible, yet they still exist in the presentation. In accordance with an aspect of the invention a routine "ReportPPTHiddenSIides" 2300 may include a step 2310 for examining each slide to determine if it is hidden and a step 2320 for reporting a data hiding incident if it is hidden as shown in FIG. 23. An exemplary examination log 2400 is shown in FIG. 24 including a plurality of major warnings 2410.

[00102] Hyperlinks can provide direct access to information in other files or presentation locations. Such links can provide access to files and presentation areas where security has not been properly defined. Hyperlinks can be defined on shapes and placed on or off slides, notes pages, the notes master, the slide master, the title master, and the handout master. In accordance with an aspect of the invention a routine "ReportPPTHyperLinks" 2500 may include a step 2510 for examining a slide master to determine the existence of a hyperlink and a step 2520 for reporting a data hiding incident as shown in FIG. 25. In a step 2530 a title master may be examined to determine the existence of a hyperlink and in a step 2540 the existence of a hyperlink may be reported. In a step 2550 each slide may be examined to determine the existence of a hyperlink and in a step 2560 the existence of a hyperlink may be reported. An exemplary examination log 2600 is shown in FIG. 26 including a plurality of major warnings 2610. [00103] Objects can provide direct access to information in other data files.

Complete application data sets can be included within a presentation slide. For example, when an Excel® (a registered trademark of the Microsoft Corporation, Redmond, WA) chart is added to a PowerPoint® slide using the cut and paste functions of these applications, the entire Excel® workbook is added to the slide. Objects can be defined on shapes and placed on or off slides, notes pages, the notes master, the slide master, the title master, and the handout master. [00104] In accordance with an aspect of the invention a routine "ReportPPTObjects" 2700 may include a step 2710 for examining each shape object of each shape on a slide master, a step 2720 for examining each shape object for each shape on a title master, a step 2730 for examining each shape object for each shape on a notes master, a step 2740 for examining each shape object for each shape on a handout master, and a step 2750 for examining each shape object on each slide and associated slide notes as shown in FIGS. 27a and 27b. In a step 2760 each object type may be examined and reported. An exemplary examination log 2800 is shown in FIG. 28 including a plurality of major warnings 2810. [00105] In areas where the color of the text matches or nearly matches the shape fill color, or if the fill is transparent the text color matches or nearly matches the slide background, the visibility of the text may be impaired. Text where text color and fill/background match or nearly match can be defined on shapes and placed on or off slides, notes pages, the notes master, the slide master, the title master, and the handout master. [00106] A routine "ReportPPTTextFillColorMatch" 2900 in accordance with an aspect of the invention may include a step 2910 for examining each shape text fill color match of each shape on a slide master, a step 2920 for examining each shape text fill color match for each shape on a title master, a step 2930 for examining each shape text fill color match for each shape on a notes master, a step 2940 for examining each shape text fill color match for each shape on a handout master, and a step 2950 for examining each shape text fill color match on each slide and associated slide notes as shown in FIGS. 29a and 29b. In a step 2960 if a shape has a text frame a background color, a font color, and a fill color are determined. If the fill is transparent, then in a step 2961 a data hiding incident is reported if the front exactly matches the background. In a step 2962, if the font nearly matches the background, a data hiding incident is reported. If shape does not have a text frame, then in a step 2963 a data hiding incident is reported if the font exactly matches the fill. In a step 2964, a data hiding incident is reported if the font nearly matches the fill. An exemplary examination log 3000 is shown in FIG. 30 including a plurality of major warnings 3010.

[00107] In areas where one shape overlaps another shape, the visibility of information may be impaired. Overlapping shapes can be defined on slides, notes pages, the notes master, the slide master, the title master, and the handout master. The present invention does not report all cases of shape overlap. Typically, slight overlaps do not hide information. Slight overlaps may be defined as 18 points. Furthermore, situations where a front shape of an overlapping shape set is transparent and situations where a back shape of an overlapping shape set has no text are not reported. [00108] In accordance with an aspect of the invention, a routine "ReportPPTOverlappingShapes" 3100 may include a step 3110 for testing overlapping shapes for a slide master, a step 3120 for testing overlapping shapes for a title master, a step 3130 for testing overlapping shapes for a notes master, a step 3140 for testing overlapping shapes for a handout master, and a step 3150 for testing overlapping shapes for each slide and associated notes as shown in FIGS. 31 a, 31 b, and 31c. In a step 3160 for each overlapping shape on a form, a width and height of each overlapping shape is compared to user settings. If the overlapping shapes are determined in step 3160 to overlap more than slightly, as determined by the user settings, then in a step 3162 a data hiding incident is reported. An exemplary examination log 3200 is shown in FIG. 32 including a plurality of major warnings 3210. [00109] In PowerPoint®, shapes contain the majority of text, pictures, links, and objects. These shapes can be placed on and off the area of a slide. As such, these shapes can be placed above, below, to the right, and to the left of a slide. In addition to slides, shapes can be placed off note pages, off the note master, off the slide master, off the title master, and off the handout master.

[00110] A routine "ReportPPTOffSlideShapes" 3300 in accordance with an aspect of the invention may include a step 3310 for examining off slide shapes for each slide master, a step 3320 for examining off slide shapes for a title master, a step 3330 for examining off slide shapes for a notes master, a step 3340 for examining off slide shapes for a handout master, and a step 3350 for examining off slide shapes for each slide and associated notes as shown in FIGS. 33a and 33b. In a step 3360, for each off slide shape a data hiding incident is reported. An exemplary examination log 3400 is shown in FIG. 34 including a plurality of major warnings 3410.

[00111] Using the margin capability of PowerPoint®, it is possible to locate shape-associated text off the area of a slide. As such, text can be located above, below, to the right, and to the left of a slide. In addition to slides, this text can be placed off note pages, off the note master, off the slide master, off the title master, and off the handout master.

[00112] In accordance with an aspect of the invention a routine

"ReportPPTOffSlideText" 3500 may include a step 3510 for examining off slide text for each slide master, a step 3520 for examining off slide text for a title master, a step 3530 for examining off slide text for a notes master, a step 3540 for examining off slide text for a handout master, and a step 3550 for examining off text shapes for each slide and associated notes as shown in FIGS. 35a and 35b. In a step 3560 for each off slide text a data hiding incident is reported. An exemplary examination log 3600 is shown in FIG. 36 including a plurality of major warnings 3610. [00113] In PowerPoint®, comments can be defined on slides. As comments can be disabled from view they are a possible data hiding concern. Multiple comments can be defined on a single slide. A routine "ReportPPTSIideComments" 3700 in accordance with an aspect of the invention 5 may include a step 3710 for determining if a shape type is a comment for each shape on each slide as shown in FIG. 37. If a shape type is a comment, in a step 3720 a data hiding incident is reported. An exemplary examination log 3800 is shown in FIG. 38 including a plurality of major warnings 3810. [00114] PowerPoint® allows notes to be assigned to each slide in a 0 presentation. The notes may not be visible to the individual viewing the presentation when a notes pane is disabled. In accordance with an aspect of the invention, a routine "ReportPPTSIideNotes" 3900 may include a step 3910 in which a determination is made whether a shape type is not a placeholder for each shape on each notes page as shown in FIG. 39. If the shape type is not a 5 placeholder, then in a step 3920 a data hiding incident is reported. An exemplary examination log 4000 is shown in FIG. 40 including a plurality of major warnings 4010.

[00115] Scripts can be defined within PowerPoint® and can be executed in response to a specific presentation event such as changing a slide or mouse 0 clicking a shape, for example. Information can be defined within a script or accessed via a script that may not be available by simple viewing of the presentation. Scripts can be defined on slides, the slide master, and the title master. [00116] A routine "ReportPPTSIideScripts" 4100 in accordance with an

2.5 aspect of the invention may include a step 4110 in which a data hiding incident is reported for each script found on a slide master as shown in FIG. 41. In a step 4120 a data hiding incident is reported for each script found on a title master and in a step 4130 a data hiding incident is reported for each script found on each slide. An exemplary examination log 4140 is shown in FIG. 41a

50 including a plurality of major warnings 4150. [00117] Sound and video media can be defined within PowerPoint® that can be executed in response to a specific presentation event such as changing a slide or mouse clicking a shape, for example. Information can be defined within a sound media and video media that may not be available by simple viewing of the presentation. Sound and video media can be defined on slides, the notes master, the handout master, the slide master, and the title master. In accordance with an aspect of the invention a routine "ReportPPTSIideMedia" 4200 may include a step 4210 for examining each shape on a slide master for slide media, a step 4220 for examining each shape on a title master for slide media, a step 4230 for examining each shape on a notes master for slide media, a step 4240 for examining each shape on a handout master for slide media, and a step 4250 for examining each shape of each slide and associated notes for slide media as shown in FIGS. 42a and 42b. In a step 4260, each slide media identified in steps 4210 through 4250 is reported as a data hiding incident. An exemplary examination log 4300 is shown in FIG. 43 including a plurality of major warnings 4310.

[00118] Pictures can be copied into PowerPoint® such that the content of the picture is either significantly reduced in scale or cropped, thereby obscuring it's content. Pictures can be defined on slides, on notes pages, the notes master, the handout master, the slide master, and the title master. A routine "ReportPPTSIidePictures" 4400 in accordance with an aspect of the invention may include a step 4410 for examining each shape of a slide master for pictures, a step 4420 for examining each shape of a title master for pictures, a step 4430 for examining each shape of a notes master for pictures, a step 4440 for examining each shape of a handout master for pictures, and a step 4450 for examining each shape on each slide and associated notes for pictures as shown in FIGS. 44a and 44b. In a step 4460, for each picture found in steps 4410 through 4450, an original size and scale is obtained, compared to user settings, and a data hiding incident is reported either the picture is cropped more than the user settings or is scaled less than a user setting. An exemplary examination log 4500 is shown in FIG. 45 including a plurality of major warnings

4510.

[00119] Certain phrases are key to possible hidden data and/or security situations. Such phrases include "secret", "proprietary", "limited", "classified", and "confidential." Such text can be defined on slides and notes pages, the notes master, the handout master, the slide master, and the title master. In accordance with an aspect of the invention, a routine "ReportPPTSearchPhrases" 4600 may include a step 4610 for examining each shape on a slide master for defined phrases (including user defined phrases), a step 4620 for examining each shape on a title master for defined phrases, a step 4630 for examining each shape on a notes master for defined phrases, a step 4640 for examining each shape on a handout master for defined phrases, and a step 4650 for examining each shape on each slide and associated notes for defined phrases as shown in FIGS. 46a and 46b. In a step 4660, a data hiding incident is reported for each shape containing a defined phrase. An exemplary examination log 4700 is shown in FIG. 47 including a plurality of major warnings 4710.

[00120] Macros in PowerPoint® presentations allow information to be hidden from view. Macros can be defined on slides and notes pages, the notes master, the handout master, the slide master, and the title master. A routine "ReportPPTSearchMacros" 4800 in accordance with an aspect of the invention may include a step 4810 for examining each shape in a slide master for macros, a step 4820 for examining each shape in a title master for macros, and a step 4830 for examining each shape in each slide and associated notes for macros as shown in FIGS. 48a and 48b. In a step 4840, a data hiding incident is reported for each macro found in steps 4810 through 4830. [00121] A routine "ResolveHiddenData" 4900 in accordance with an aspect of the invention may include a step 4910 in which a determination may be made whether user action for resolving data hiding incidents has been taken as shown in FIGS. 49a and 49b. If user action has been taken, then in a step 4920 a type of resolution may be selected including a step 4930 in which data hiding incidents may be removed. An exemplary report log 5000 is shown in FIG. 50 including a plurality of reports 5010. [00122] In FIG. 51 , an exemplary user interface 5100 may include a plurality of user options 5110 for removing data hiding incidents, adding data hiding incidents to a new slide, adding data hiding incidents to a backup slide, feature based resolution, and determining resolution at a resolve time. The user interface 5100 may also include user confirmation 5120. [00123] The system and method of the invention provides for identifying, classifying, extracting, and resolving hidden information from data files. The routines described herein are operable to examine a data file for hidden entities and generate an examination log whereby incidences of hidden entities are recorded including major and minor warning messages. The examination may be displayed in a user interface. When warning messages are selected by a user, the application containing the hidden entities may be brought to the foreground for user action and resolution.

[00124] It should be understood, of course, that the foregoing relates to preferred embodiments of the invention and that modifications may be made without departing from the spirit and scope of the invention as set forth in the following claims.

Claims

WE CLAIM:

1. A method for identifying, classifying, extracting and resolving hidden entities from a data file comprising: searching for an executing copy of an application associated with the data file; initiating the application in a background if the application is not running; opening the data file for reading only; examining the data file for hidden entities; and generating an examination log of incidents of hidden entities.

2. The method of claim 1 , wherein examining the data file for hidden entities further comprises executing a plurality of algorithms.

3. The method of claim 2, wherein executing the plurality of algorithms further comprises executing an algorithm operable to report non visible shapes.

4. The method of claim 2, wherein executing the plurality of algorithms further comprises executing an algorithm operable to report picture font text.

5. The method of claim 2, wherein executing the plurality of algorithms further comprises executing an algorithm operable to report font size.

6. The method of claim 2, wherein executing the plurality of algorithms further comprises executing an algorithm operable to report shape size.

7. The method of claim 2, wherein executing the plurality of algorithms further comprises executing an algorithm operable to report alternative text.

8. The method of claim 2, wherein executing the plurality of algorithms further comprises executing an algorithm operable to report hidden slides.

9. The method of claim 2, wherein executing the plurality of algorithms further comprises executing an algorithm operable to report hyperlinks.

10. The method of claim 2, wherein executing the plurality of algorithms further comprises executing an algorithm operable to report objects.

11. The method of claim 2, wherein executing the plurality of algorithms further comprises executing an algorithm operable to report text, fill, background and color matches.

12. The method of claim 2, wherein executing the plurality of algorithms further comprises executing an algorithm operable to report overlapping shapes.

13. The method of claim 2, wherein executing the plurality of algorithms further comprises executing an algorithm operable to report off slide shapes.

14. The method of claim 2, wherein executing the plurality of algorithms further comprises executing an algorithm operable to report off slide text.

15. The method of claim 2, wherein executing the plurality of algorithms further comprises executing an algorithm operable to report slide comments.

16. The method of claim 2, wherein executing the plurality of algorithms further comprises executing an algorithm operable to report slide notes.

17. The method of claim 2, wherein executing the plurality of algorithms further comprises executing an algorithm operable to report slide scripts.

18. The method of claim 2, wherein executing the plurality of algorithms further comprises executing an algorithm operable to report slide media.

19. The method of claim 2, wherein executing the plurality of algorithms further comprises executing an algorithm operable to report slide pictures.

20. The method of claim 2, wherein executing the plurality of algorithms further comprises executing an algorithm operable to report search phrases.

21. The method of claim 2, wherein executing the plurality of algorithms further comprises executing an algorithm operable to report macros.

22. The method of claim 1 , further comprising resolving the incidents of hidden entities.

23. A method for identifying, classifying, extracting and resolving hidden entities from a data file comprising: searching for an executing copy of an application associated with the data file; initiating the application in a background if the application is not running; opening the data file for reading only; examining the data file for hidden entities including non visible shapes, picture font text, alternative text, hidden slides, hyperlinks, objects, text, fill and background color matches, overlapping shapes, off slide shapes, off slide text, slide comments, slide notes, slide scripts, slide media, slide pictures, and macros; generating an examination log of incidents of hidden entities; and resolving the incidents of hidden entities.

24. The method of claim 23, further comprising reporting font names, font size, shape size, and search phrases in the examination log.

25. The method of claim 22, further comprising resolving the hidden entities.

26. A system for identifying, classifying .extracting and resolving hidden entities from a data file comprising: a memory coupled to a processor, the processor operable to search for an executing copy of an application associated with the data file, initiate the application in a background if the application is not running, open the data file for reading only, examine the data file for hidden entities, and generate an examination log of incidents of hidden entities.

27. The system of claim 26, wherein examining the data file for hidden entities further comprises executing a plurality of algorithms.

28. The system of claim 27, wherein executing the plurality of algorithms further comprises executing an algorithm operable to report non visible shapes.

29. The system of claim 27, wherein executing the plurality of algorithms further comprises executing an algorithm operable to report picture font text.

30. The system of claim 27, wherein executing the plurality of algorithms further comprises executing an algorithm operable to report font size.

31. The system of claim 27, wherein executing the plurality of algorithms further comprises executing an algorithm operable to report shape size.

32. The system of claim 27, wherein executing the plurality of algorithms further comprises executing an algorithm operable to report alternative text.

33. The system of claim 27, wherein executing the plurality of algorithms further comprises executing an algorithm operable to report hidden slides.

34. The system of claim 27, wherein executing the plurality of algorithms further comprises executing an algorithm operable to report hyperlinks.

35. The system of claim 27, wherein executing the plurality of algorithms further comprises executing an algorithm operable to report objects.

36. The system of claim 27, wherein executing the plurality of algorithms further comprises executing an algorithm operable to report text, fill, background and color matches.

37. The system of claim 27, wherein executing the plurality of algorithms further comprises executing an algorithm operable to report overlapping shapes.

38. The system of claim 27, wherein executing the plurality of algorithms further comprises executing an algorithm operable to report off slide shapes.

39. The system of claim 27, wherein executing the plurality of algorithms further comprises executing an algorithm operable to report off slide text.

40. The system of claim 27, wherein executing the plurality of algorithms further comprises executing an algorithm operable to report slide comments.

41. The system of claim 27, wherein executing the plurality of algorithms further comprises executing an algorithm operable to report slide notes.

42. The system of claim 27, wherein executing the plurality of algorithms further comprises executing an algorithm operable to report slide scripts.

43. The system of claim 27, wherein executing the plurality of algorithms further comprises executing an algorithm operable to report slide media.

44. The system of claim 27, wherein executing the plurality of algorithms further comprises executing an algorithm operable to report slide pictures.

45. The system of claim 27, wherein executing the plurality of algorithms further comprises executing an algorithm operable to report search phrases.

/

46. The system of claim 27, wherein executing the plurality of algorithms further comprises executing an algorithm operable to report macros.

47. The system of claim 26, wherein the processor is further operable to resolve the incidents of hidden entities.

48. A computer readable media for identifying, classifying, extracting and resolving hidden entities from a data file comprising: a code segment for searching for an executing copy of an application associated with the data file; a code segment for initiating the application in a background if the application is not running; a code segment for opening the data file for reading only; a code segment for examining the data file for hidden entities; and a code segment for generating an examination log of incidents of hidden entities.

49. The computer readable media of claim 48, wherein the code segment for examining the data file for hidden entities further comprises a code segment for executing a plurality of algorithms.

50. The computer readable media of claim 49, wherein the code segment executes an algorithm operable to report non visible shapes.

51. The computer readable media of claim 49, wherein the code segment executes an algorithm operable to report font text.

52. The computer readable media of claim 49, wherein the code segment executes an algorithm operable to report font size.

53. The computer readable media of claim 49, wherein the code segment executes an algorithm operable to report shape size.

54. The computer readable media of claim 49, wherein the code segment executes an algorithm operable to report alternative text.

55. The computer readable media of claim 49, wherein the code segment executes an algorithm operable to report hidden slides.

56. The computer readable media of claim 49, wherein the code segment executes an algorithm operable to report hyperlinks.

57. The computer readable media of claim 49, wherein the code segment executes an algorithm operable to report objects.

58. The computer readable media of claim 49, wherein the code segment executes an algorithm operable to report text, fill, background and color matches.

59. The computer readable media of claim 49, wherein the code segment executes an algorithm operable to report overlapping shapes.

60. The computer readable media of claim 49, wherein the code segment executes an algorithm operable to report off slide shapes.

61. The computer readable media of claim 49, wherein the code segment executes an algorithm operable to report off slide text.

62. The computer readable media of claim 49, wherein the code segment executes an algorithm operable to report slide comments.

63. The computer readable media of claim 49, wherein the code segment executes an algorithm operable to report slide notes.

64. The computer . readable media of claim 49, wherein the code segment executes an algorithm operable to report slide scripts.

65. The computer readable media of claim 49, wherein the code segment executes an algorithm operable to report slide media.

66. The computer readable media of claim 49, wherein the code segment executes an algorithm operable to report slide pictures.

67. The computer readable media of claim 49, wherein the code segment executes an algorithm operable to report search phrases.

68. The computer readable media of claim 49, wherein the code segment executes an algorithm operable to report macros.

69. The computer readable media of claim 48, further comprising a code segment for resolving the incidents hidden entities.