[1] [1] GARFINKEL S L，MIGLETZ J J. New XML-based files implications for forensics[J]. IEEE Security & Privacy，2009，7（2）： 38-44.

[2] [2] FU Z J，SUN X M，LIU Y L，et al.Forensic investigation of OOXML format documents[J]. Digital Investigation,2011,8（1）： 48-55.

[3] [3] FU Z J, SUN X M, ZHOU L,et al.New forensic methods for OOXML format documents[M]. Berlin, Germany： Springer, 2014：503-513.

[4] [4] FU Z J, SUN X M, XI J. Digital forensics of Microsoft Office 2007—2013 documents to prevent covert commu-nication[J]. Journal of Communications and Networks, 2015, 17（5）： 525-533.

[5] [5] DIDRIKSEN E. Forensic Analysis of OOXML Documents[C/OL]. [2024-08-01].https：//9pdf.net/document/yr3dvo0v-forensic-analysis-of-ooxml-documents.html.

[9] [9] SPENNEMANN D H R, SPENNEMANN R J. Establishing genealogies of born digital content： The suitability of revision identifier （RSID） numbers in MS word for forensic enquiry[J]. Publications，2023，11（3）： 35.

[10] [10] SPENNEMANN D H R，SINGH C L. Generation of revision identifier （RSID） numbers in MS word[J]. International Journal of Digital Curation，2024, 18（1）： 22.

[11] [11] JOUN J H，HAN J，JUNG D，et al.Study on history tracking technique of the document file through RSID analysis in MS Word[J]. Journal of the Korea Institute of Information Security & Cryptology，2018，28（6）：1439-1448.

[12] [12] JOUN J, CHUNG H, PARK J,et al.Relevance analysis using revision identifier in MS Word[J]. Journal of Forensic Sciences, 2021, 66（1）： 323-335.

[13] [13] LANGWEG H. OOXML file analysis of the July 22nd terrorist manual[M]. Berlin, Germany：Springer，2012：195-197.

[14] [14] JOHNSON C，DAVIES R. Using digital forensic techniques to identify contract cheating： A case study[J]. Journal of Academic Ethics，2020, 18（2）： 105-113.