Volume Serial Numbers (like for Windows Partitions) Applied to MS Office Files

• Download the free FILESVOL PoC - 6.5 KB
• Download code of FILESVOL (50 LOC) - 60.1 KB

Introduction

This article examines the use and implementation of the computing algorithm of VSN, which stands for Volume Serial Number, enhancing the calculations made by Windows Operating System to provide a string like AB0C-1DEF or something alike. This kind of string is what we need to read, by typing vol c:\ or vol d:\ or vol other letter, inside of a command prompt, and it's called volume serial number of a given partition.

The goal of the article is to show that the same algorithm applied by Windows in computing the Volume Serial Number (VSN) of a certain partition, can be used to reveal the VSN of a file or folder of ours chosen by us to make the VSN calculations for.

First of all, remember that the volume serial number of a given partition is calculated on a date-and-time basis. In other words, the moment the partition is created - date as year, month, day and time as hour, minute, second and millisecond - are converted into an alphanumerical string, which contains the characters used to write HEX numbers (figures like 0-9 and letters like A-F) - the reason the VSN serial number looks like AB0C-1DEF for.

The partition's creation date & time are processed through an open, free to use algorithm, like in the picture below:

What Does the Code Snippet Do?

It translates into VB.NET 2010 code the calculations needed to prompt the Volume Serial Number of a file, which are the same calculations made by Windows to provide the volume serial number of a partition. Actually, we need: the file creation date and time - provided by native VB.NET code, one open file dialog and, at least, to convert the file creation date and time into a HEX value using the hex(something) method.

NOTE: No changes will be made upon the Office file(s) you'll choose to use as samples in your calculations. The solution above is just a Proof of Concept made to demonstrate ONLY how to calculate Volume Serial Number of a File, without labeling the sample Office files by storing the label as file content or metadata and without making any other changes on any of your file(s) to this matter !

How the VSN algorithm works and how may this solution use it on Office files?

First of all, try to focus on the image above, which explains the Volume Serial Number algorithm:

1. Mind in the picture above how the month (October) and the day (19^th) from the file creation date on a side, and the second (27) and the 1/100s of a second (0.01) from the file creation time on the other side - are being converted each one into HEX, and how to merge the results to obtain the first HEX sum's terms
2. Concerning the other terms provided by the file creation date and time, the same algorithm is being applied both for file creation hour (22 Hour), minute (33 Min) from the file creation time and for file creation year (2003) from the file creation time too. We now have the second term of the final sum, after we merged the strings obtained by converting the hour, minute and year into HEX.
3. The last step is to calculate the final HEX sum, between the both sums as above.

The sum obtained above reflects that a file created on the 19^th of October, 2003 (as date) at 22 hrs 33 min and 27.001 sec (as time) will provide 2514-1df4 as volume serial number.

Background

For a better understanding of metadata - as they are reported by Office files (as "created date", "author") and how to read and modify them, please consider reading:

• View or change the properties for an Office file

What Does the PoC Do?

It calculates the volume serial number (vol) of a Microsoft Office File in one single step. To calculate VSN of your own file(s), download a copy of the PoC which will help you to improve your knowledge both in metadata applied to MS Office files and in Windows variables too.

Using the Code

The code is comprised in less than 50 LOC (i.e., lines of code), and a great part consists in the algorithm needed to calculate the VSN of the file the user loads for calculations.

First of all, let's mention that the native VB.NET code provides routines used by programmers to prompt every moment within a file lifespan, like: date and time of file creation, when the file was last saved, last printed and last modified. Our code also extracts the date and time of every action made on the loaded Office file, using only VB.NET native routines (such as directory.getfileinfo(...)).

Let's reveal the date and time of:

1. file creation
2. last save
3. last print
4. last modified

...by using the code below (Note: We'll use the file creation moment to make the calculations needed to provide the VSN).

' Let us calculate the file creation date and time, used to calculate the VOL
Function file_cd(ByVal filename As String) As DateTime
        file_cd = File.GetCreationTime(filename)
        Return file_cd
End Function

' Now we reveal the date and time when the file was last accessed
Function file_la(ByVal filename As String) As DateTime
        file_la = File.GetLastAccessTime(filename)
        Return file_la
End Function

' Finally, the last written date and time moment of the file provides us how recent the user 
' edited or simply saved the file we chose to analyse through these calculations
Function file_lw(ByVal filename As String) As DateTime
        file_lw = File.GetLastWriteTime(filename)
        Return file_lw
End Function

And now, we'll know, step by step, how the file creation date and time is divided into elements such as month, day and year as date elements on one side, and hour, minute, second and 100^ths of seconds as time elements on the other side.

We learned in the introductory paragraph above, that we need to convert the date elements, as good as the time elements into HEX based numbers to make the algorithm possible to be applied. Let's see how to do these:

Dim cdatetime As DateTime = File.GetCreationTime(filename)
        Dim hex_cmon As String = Hex(CInt(cdatetime.Month))
        Dim hex_cday As String = Hex(CInt(cdatetime.Day))
        Dim hex_csec As String = Hex(CInt(cdatetime.Second))
        Dim hex_cms As String = Hex(CInt(Int((cdatetime.Millisecond / 10))))
        Dim hex_chour As String = Hex(CInt(cdatetime.Hour))
        Dim hex_cmin As String = Hex(CInt(cdatetime.Minute))
        Dim hex_cyr As String = Hex(CInt(cdatetime.Year))

Note that the elements are being converted into HEX numbers regarding the order used by the VSN algorithm to provide the final VSN string (see the picture for further learnings).

The next step consists in obtaining the both of the sums, added finally to each other, to provide the VSN label of the file or folder we choose as calculation sample, as from the learnings from the code below:

Dim hex_cmon_cday As String = hex_cmon & hex_cday
        Dim hex_csec_cms As String = hex_csec & hex_cms
        Dim hex_chour_cmin As String = hex_chour & hex_cmin
        ' Dim hex_cyr As String = Hex(CInt(cdatetime.Year))

        Dim vol_1, vol_2, vol_3, vol_4, vol_12, vol_34 As Long
        vol_1 = CLng("&H" & hex_cmon_cday)
        vol_2 = CLng("&H" & hex_csec_cms)
        vol_3 = CLng("&H" & hex_chour_cmin)
        vol_4 = CLng("&H" & hex_cyr)
        vol_12 = vol_1 + vol_2
        vol_34 = vol_3 + vol_4

Finally, let's obtain the string needed to be read as Volume Serial Number of a file. Let's remember that Windows prompts this string as two groups of 4 characters each (letters from A to F and figures from 0 to 9), divided by a minus "-". (i.e., the VSN shown in the picture above is 2514-1df4. As long as 0 (zero) is accepted as legal character in VSN labeling, the final result will be truncated, I mean that 0 will not be shown (i.e., a VSN label like 0ABC-1234 will appear as ABC-1234 - totally wrong regarding the VOL label format). That's why some zeros are needed in our code, as long as we can make it dynamically.

To ease the understanding, first_sum is sampled in the picture as 2514 and second_sum as 1df4.

Dim first_sum As String = Hex(vol_12)
      Dim second_sum As String = Hex(vol_34)
      If Len(first_sum) = 3 Then : first_sum = first_sum & 0
      ElseIf Len(first_sum) = 2 Then : first_sum = first_sum & "00"
      ElseIf Len(first_sum) = 1 Then : first_sum = first_sum & "000"
      End If
      If Len(second_sum) = 3 Then : second_sum = second_sum & 0
      ElseIf Len(second_sum) = 2 Then : second_sum = second_sum & "00"
      ElseIf Len(second_sum) = 1 Then : second_sum = second_sum & "000"
      End If
      vol = first_sum & "-" & second_sum

The entire code needed to convert the creation date and time of any file is listed below:

(NOTE that our piece of software needs to load a file the code below computes the VSN label for. The source code using module, form and project files to be loaded in a VB.NET 2010+ IDE can be found inside of the archive available for download at the beginning of this article).

Imports System.IO

Module mdlfiledate

    Function file_cd(ByVal filename As String) As DateTime
        file_cd = File.GetCreationTime(filename)
        Return file_cd
    End Function

    Function file_la(ByVal filename As String) As DateTime
        file_la = File.GetLastAccessTime(filename)
        Return file_la
    End Function

    Function file_lw(ByVal filename As String) As DateTime
        file_lw = File.GetLastWriteTime(filename)
        Return file_lw
    End Function

    Function vol(ByVal filename As String) As String
        Dim cdatetime As DateTime = File.GetCreationTime(filename)
        Dim hex_cmon As String = Hex(CInt(cdatetime.Month))
        Dim hex_cday As String = Hex(CInt(cdatetime.Day))
        Dim hex_csec As String = Hex(CInt(cdatetime.Second))
        Dim hex_cms As String = Hex(CInt(Int((cdatetime.Millisecond / 10))))
        Dim hex_chour As String = Hex(CInt(cdatetime.Hour))
        Dim hex_cmin As String = Hex(CInt(cdatetime.Minute))
        Dim hex_cyr As String = Hex(CInt(cdatetime.Year))

        Dim hex_cmon_cday As String = hex_cmon & hex_cday
        Dim hex_csec_cms As String = hex_csec & hex_cms
        Dim hex_chour_cmin As String = hex_chour & hex_cmin
        ' Dim hex_cyr As String = Hex(CInt(cdatetime.Year))

        Dim vol_1, vol_2, vol_3, vol_4, vol_12, vol_34 As Long
        vol_1 = CLng("&H" & hex_cmon_cday)
        vol_2 = CLng("&H" & hex_csec_cms)
        vol_3 = CLng("&H" & hex_chour_cmin)
        vol_4 = CLng("&H" & hex_cyr)
        vol_12 = vol_1 + vol_2
        vol_34 = vol_3 + vol_4

        Dim first_sum As String = Hex(vol_12)
        Dim second_sum As String = Hex(vol_34)
        If Len(first_sum) = 3 Then : first_sum = first_sum & 0
        ElseIf Len(first_sum) = 2 Then : first_sum = first_sum & "00"
        ElseIf Len(first_sum) = 1 Then : first_sum = first_sum & "000"
        End If
        If Len(second_sum) = 3 Then : second_sum = second_sum & 0
        ElseIf Len(second_sum) = 2 Then : second_sum = second_sum & "00"
        ElseIf Len(second_sum) = 1 Then : second_sum = second_sum & "000"
        End If
        vol = first_sum & "-" & second_sum
    End Function

End Module

Points of Interest

Download the code available behind the second link from above, at the very beginning of this article. Unzip the content and load the project file using a VB.NET IDE. Read the code, compile it and enjoy!

NOTE: The .NET 4.0 Framework needs to be activated (if installed) from Windows Features, no matter what Windows OS version you're running.

History

No previous versions or concepts regarding this project are available. Further and improved versions of this code will be published as soon as they will be tested and made available to use.