while checking old backups i came across an oddity. some *.xls files have slightly changed binary content while the timestamp is unchanged (mod time identical, last access and created different of course).
from typical similar small changes in *.xls files, see details below, and only in them, i think it’s not a result of hard- or software malfunction, but intentional from a program which had accessed the files.
the files have been created with excel (2007?) under windows, copied for backed purpose once and again at different times, may be accessed in between, may be with excel, may be with various versions of LO calc, and moved around on different usb-sticks (mostly formatted ‘fat32’ … the history is not documented.
i’d like to know when and why such alterations may occur, and what they result from, as well to improve my knowledge, as to avoid it for the future.
(i like quick backups with hardlinked files done by rsync, i’d like to know when space is wasted reg. changes in files, and i’d like to have backups which say ‘binary identical’ on later diff’s, preferred to ‘binary files differ’.)
the changes in detail: each file contains one block starting with ‘Root Entry’ written in a ‘two byte encoded’ format as hex: ‘52 00 6F 00 6F 00 74 00 …’ with 8 lines of 16 bytes, mostly ‘00’. after that block it continues with ‘Workbook’ in the same notation, hex: ‘57 00 6F 00 72 00 6B 00 …’. byte 109 to 116 (decimal) of this block (counted from the ‘R’ of ‘Root Entry’ as 1) (byte hex 0x6c to 0x73 started with 0x00) are subject to the changes. while often ‘00 00 00 00 00 00 00 00’ they are changed to some non alpanumeric value in some of the files. !while the modification time stays unchanged!.
see screenshot below.
anybody any idea? perhaps metadata like hidden access time entry? selected sheet and cursor position? NSA stamp ‘already copied’?
pls. avoid answers propagating better backup procedures - i can’t change the past, against usb sticks - the same, and assumptions it could be accidental errors - they are far too typical and ‘solo’ for that.