<?xml version="1.0" encoding="utf-8"?>
<PRONOM-Report xmlns="http://pronom.nationalarchives.gov.uk">
  <report_format_detail>
    <FileFormat>
      <FormatID>1281</FormatID>
      <FormatName>Microsoft Office Encrypted Document</FormatName>
      <FormatVersion>2007 Onwards</FormatVersion>
      <FormatAliases>
      </FormatAliases>
      <FormatFamilies>
      </FormatFamilies>
      <FormatTypes>Presentation, Spreadsheet, Word Processor</FormatTypes>
      <FormatDisclosure>
      </FormatDisclosure>
      <FormatDescription>A Microsoft Office - Word, Excel, or PowerPoint document, that has been encrypted.

The encrypted document conforms to the MS-OFFCRYPTO specification, as found here:
http://msdn.microsoft.com/en-us/library/cc313071(v=office.12).aspx

The document is an OLE2 compound that contains a number of files:

EncryptionInfo - This file contains information used by the Office-compatible application to decrypt the encrypted package. There are multiple variants of this file, as described in 2.3.4.5, and 2.3.4.6 of the format specification.

EncryptedPackage - This file contains the whole of the encrypted document. 

DataSpaces folder (and sub-files) - This structure associates protected content with data space definitions. The data space definition, in turn, describes the series of transforms that must be applied to that protected content to restore it to its original form.

Since the method of identifying and distinguishing specific types of OOXML documents relies on seeking and analysing specific elements within the document, and in the case of encryption this information is obfuscated, it does not currently seem possible to determine with any specificity whether an encrypted file is either an Excel, Word, or PowerPoint document, apart from the file extension.</FormatDescription>
      <BinaryFileFormat>
      </BinaryFileFormat>
      <ByteOrders>
      </ByteOrders>
      <ReleaseDate>
      </ReleaseDate>
      <WithdrawnDate>
      </WithdrawnDate>
      <ProvenanceSourceID>1</ProvenanceSourceID>
      <ProvenanceName>Digital Preservation Department / The National Archives</ProvenanceName>
      <ProvenanceSourceDate>26 Feb 2013</ProvenanceSourceDate>
      <ProvenanceDescription>This format can be identified via a container signature in DROID version 6 or later. The PRONOM database cannot currently represent container signatures.</ProvenanceDescription>
      <LastUpdatedDate>26 Feb 2013</LastUpdatedDate>
      <FormatNote>
      </FormatNote>
      <FormatRisk>
      </FormatRisk>
      <TechnicalEnvironment>
      </TechnicalEnvironment>
      <FileFormatIdentifier>
        <Identifier>fmt/494</Identifier>
        <IdentifierType>PUID</IdentifierType>
      </FileFormatIdentifier>
      <Developers>
        <DeveloperID>93</DeveloperID>
        <DeveloperName>
        </DeveloperName>
        <OrganisationName>Microsoft Corporation</OrganisationName>
        <DeveloperCompoundName>Microsoft Corporation</DeveloperCompoundName>
      </Developers>
      <Support>
        <SupportID>93</SupportID>
        <SupportName>
        </SupportName>
        <OrganisationName>Microsoft Corporation</OrganisationName>
        <SupportCompoundName>Microsoft Corporation</SupportCompoundName>
      </Support>
      <ExternalSignature>
        <ExternalSignatureID>1305</ExternalSignatureID>
        <Signature>xlsx</Signature>
        <SignatureType>File extension</SignatureType>
      </ExternalSignature>
      <ExternalSignature>
        <ExternalSignatureID>1306</ExternalSignatureID>
        <Signature>pptx</Signature>
        <SignatureType>File extension</SignatureType>
      </ExternalSignature>
      <ExternalSignature>
        <ExternalSignatureID>1307</ExternalSignatureID>
        <Signature>docx</Signature>
        <SignatureType>File extension</SignatureType>
      </ExternalSignature>
    </FileFormat>
    <SearchCriteria>Criteria</SearchCriteria>
  </report_format_detail>
</PRONOM-Report>
