The names themselves may be meaningful, perhaps as Unix timestamps, but I'm not sure.Įach of these data streams in the wrapper are themselves compressed CFB files, where, similar to to the MSO file itself, the first 4 bytes represent the inflated length with the deflated data following. This wrapper CFB contains 1 or more data streams (as defined in ), The remaining bytes represent a deflated CFB file, which I will call the 'wrapper'. The first 4 bytes of the MSO file represent the inflated size of the data that follows. There are actually two levels of deflation, where the underlying OLE / CFB files areĭeflated and stored inside a wrapping or parent CFB file, which is itself deflated in the MSO.
It does not seem to be gzipped data, as stated earlier by Mark, but instead uses plain deflate. I'm late to the party, but I have more information about the MSO format.
