Strategy: Start MS Publisher Create Empty Document File/Save, foo.pub File/Exit. copy foo.pub foo1.pub Start MS Publisher Create Empty Document File/Save, foo.pub (one difference: Confirm overwrite) File/Exit. Compare foo.pub, foo1.pub. These files should be identical. Diff: Only 49 bytes. The diffs in 1,5,6 - of 7, as usual. This seems to be a "stub" of the main diff: 1132 2154 0 0 224 e0 1133 2155 91 5b '[' 211 d3 1134 2156 16 10 3 3 1135 2157 74 4a 'J' 88 58 'X' 1136 2160 239 ef 239 ef 1137 2161 170 aa 170 aa 1138 2162 199 c7 199 c7 1139 2163 1 1 1 1 ... But it ends with a five. The others end with zero....... 1140 2164 5 5 5 5 This is the generic diff: 4 differ, 4 match, 4 differ, 4 match. 1252 2344 0 0 224 e0 1253 2345 234 ea 211 d3 1254 2346 13 d 3 3 1255 2347 74 4a 'J' 88 58 'X' 1256 2350 239 ef 239 ef 1257 2351 170 aa 170 aa 1258 2352 199 c7 199 c7 1259 2353 1 1 1 1 1260 2354 0 0 224 e0 1261 2355 91 5b '[' 211 d3 1262 2356 16 10 3 3 1263 2357 74 4a 'J' 88 58 'X' 1264 2360 239 ef 239 ef 1265 2361 170 aa 170 aa 1266 2362 199 c7 199 c7 1267 2363 1 1 1 1 1268 2364 0 0 0 0 Okay; this is a block of: 00,ea,0d,4a,ef,aa,c7,01 00,5b,10,4a,ef,aa,c7,01 vs e0,d3,03,58,ef,aa,c7,01 e0,d3,03,58,ef,aa,c7,01 Two strings of 8 bytes, each ending in "01". Or, another way: 00,ea,0d,4a,ef,aa,c7,01 e0,d3,03,58,ef,aa,c7,01 and then 00,5b,10,4a,ef,aa,c7,01 e0,d3,03,58,ef,aa,c7,01 So, byte 1 is 00/e0; byte 5-8 is ef,aa,c7,01. The diff is : 00 ea 0d 4a ... vs : e0 d3 03 58 1380 (1252 + 128) : Again 1508 (1380 + 128): Again 1636 (1508 + 128): Again .... outfile5 : 48804 137244 49 31 '1' 52 34 '4' This is the "LOCALS@1\Temp\pub4.tmp" vs "LOCALS~1\Temp\pub1.tmp" ---- outfile6: 58468: Again These 4 match the c6/c7 we've seen as part of the previous block: 60298 165612 182 b6 183 b7 +30 60328 165650 182 b6 183 b7 +440 60768 166540 182 b6 183 b7 +82 60850 166662 182 b6 183 b7
$ bc
bc 1.06
Copyright 1991-1994, 1997, 1998, 2000 Free Software Foundation, Inc.
This is free software with ABSOLUTELY NO WARRANTY.
For details type `warranty'. 
ibase=16
E0D30358EFAAC7
63282406113651399
steve@elvis:~/c/pub/5$ date +%s
1181433392
I can't see any correlation with the number 30D30358EFAAC7 and the current date, then. At least, not in UNIX terms.