Microsoft Office Auto-Recover Locations

Virtually every user of Microsoft Office has had the pain of seeing their computer, or their Office program, crash with a long period of unsaved work suddenly disappearing, followed by the relief of being able to get most of it back when they restart. Most have also known the frustration when that doesn’t work. One of the reasons it may not work is because the location where the autorecover files are put is no longer available. By default Office will put the autorecover file in roaming data, which can make it convenient to be able to recover on a computer other than the one you were previously editing on but roaming data has the most things that can go wrong.

The basic things to remember are:

  • The setting is saved per user. If you log into a computer using more than one login id then each will have their own location for autorecover files and you will need to do any customization separately for each.
  • There is a separate setting for each of the Office programs. If you set a different location for Excel autorecover files it will not change for Word, Powerpoint, etc.
  • Speaking personally when something has gone really bad in Office and I am in a panic to be sure there is an Auto-Recovery of my work I don’t want to spend a lot of time drilling down a long file path and remembering where it is. So I just create a top level folder called C:\OfficeRecovery. Simple and clear. But you might decide to put it in a subfolder of C:\ ProgramData or whatever.

To change the setting as an end user.

  • Open the Office program you wish to change. Remember that Word, Excel, Powerpoint, etc. each has their own setting. Open a blank document if one is not done so automatically.
  • Select the File Menu
  • Under the File Menu select Options (It will be at or near the bottom)
  • From the category list in the Options Dialog select Save
  • ExcelOptions
  • File – Options – Save Dialog for Excel

The dialog includes a check box to enable/disable the Autorecovery feature (definitely recommended to keep that checked), the autorecovery timer in minutes, and both the autorecovery and default save location.
To change the setting as an Administrator for all users.

In order to manage Office centrally you need to download the Office Administrative Template Files and Office Customization Tools. There are separate versions for each major version office (2007, 2010, 2013). This will allow these settings to be managed by Group Policy.

Setting via the Registry 

The location in the registry is: HKEY_CURRENT_USER/Software/Microsoft/Office/14.0/(Product)/Options/AutoRecoverPath with (Product) being replaced with Word, Excel, Powerpoint, etc.

Forensic Examination Uses

 

Auto-recovery files are one of those easily overlooked locations in examinations, particularly since the file extensions used are nonstandard (.asd for Word and .xar for Excel) and thus may be overlooked in a search for ‘office documents’. In the same way though, they may well be overlooked by a user trying to ‘cover their tracks’. Thus they may be a place to find hidden gems.

One particularly tasty use for the forensic examiner is if the user had been using Microsoft Office to edit documents on an external USB flash drive.  The flash drive may be gone but unless they turned off autorecover feature (or directed it to save the auto-recover file to the flash drive as well) the auto-recover version will still be there either directly or in the unallocated clusters.

This may also provide a window into encrypted volumes.  Once again, unless the user turned off auto-recover or directed it to the encrypted volume as well then those auto-recover files will be available on the hard disk or the unallocated clusters

Manual Auto-recovery use.

Sometimes auto-recovery will not show the availability of an auto-recovery file even though it exists. I am not sure exactly why this would be the case, but it does seem to occasionally happen. The auto-recovery files, despite having a different file extension, are no different than the native file format for that Office application and can simply be renamed and opened. Note that no matter what the format of the original document the auto-recover file will be of the native file format. So for example you may be working with a plain text or rtf file in word but the auto-recover .asd file will be in .docx format.

2 comments

  1. nice looking blog 🙂

  2. I wanted to thank you for this good read!! I certainly enjoyed every bit
    of it. I’ve got you bookmarked to look at new things you post…

Leave a Reply

Your email address will not be published.