Excel Metadata Differences: Mac vs Windows

Why Platform Matters for Metadata

Both Mac and Windows versions of Excel save files in the same XLSX format — a ZIP archive containing XML documents. The core file structure is identical: docProps/core.xml stores author and timestamp properties, docProps/app.xml stores application metadata, and the various xl/ subdirectories hold worksheets, styles, and shared strings.

However, the two applications are developed by different engineering teams at Microsoft using different codebases. Excel for Windows is the older, more feature-complete product. Excel for Mac was rewritten from scratch for the modern macOS platform. These separate development histories mean the applications populate metadata fields differently, expose different inspection tools, and handle edge cases in ways that can trip up even experienced users.

Key Differences at a Glance

Windows Excel

• Full Document Inspector with all categories
• Author sourced from Office account or Windows login
• Application string: “Microsoft Excel”
• Full VBA editor with rich metadata
• COM add-in metadata in app.xml
• Extended file properties via NTFS
• PowerQuery connection strings embedded

Mac Excel

• Simplified Document Inspector (fewer categories)
• Author sourced from Office account or macOS user
• Application string: “Microsoft Excel for Mac”
• VBA editor with limited metadata exposure
• No COM add-in metadata
• Extended attributes via macOS xattr
• PowerQuery not available (no connection metadata)

Author and Identity Metadata

The author name embedded in an Excel file is one of the most privacy-sensitive metadata fields. Both platforms write the author to docProps/core.xml using the dc:creator and cp:lastModifiedBy fields. However, where the author name comes from differs.

Windows Author Resolution

On Windows, Excel first checks the signed-in Microsoft 365 account name. If no account is signed in, it falls back to the Windows user profile display name. If Excel was installed via volume licensing without personalization, it may use the organization name or a generic “User” string. The author field can be changed in File → Info → Properties, but this only affects the current file.

Mac Author Resolution

On Mac, Excel checks the signed-in Microsoft 365 account first, just like Windows. If no account is signed in, it pulls the full name from the macOS user account (System Settings → Users & Groups). Older versions of Excel for Mac occasionally used the macOS computer name as a fallback, which could embed your machine's hostname into every file you create.

Cross-Platform Author Inconsistency

When the same user edits a file on both platforms, the dc:creator field retains the original author, but cp:lastModifiedBy updates to reflect the current platform's author resolution. This can create a mismatch where the creator appears as “John Smith” (from Windows Active Directory) and the last modifier appears as “john” (from a macOS username). In forensic investigations, this is not evidence of tampering — it is simply a cross-platform artifact.

Application Fingerprint Differences

Every Excel file records which application created or last saved it in docProps/app.xml. This fingerprint is one of the most reliable ways to determine which platform was used.

Application Metadata in app.xml

<!-- Windows Excel -->
<Properties xmlns="...extended-properties">
  <Application>Microsoft Excel</Application>
  <AppVersion>16.0300</AppVersion>
  <Company>Contoso Ltd</Company>
  <Manager>Jane Doe</Manager>
</Properties>

<!-- Mac Excel -->
<Properties xmlns="...extended-properties">
  <Application>Microsoft Excel for Mac</Application>
  <AppVersion>16.89</AppVersion>
  <Company></Company>
  <Manager></Manager>
</Properties>

Several differences stand out. First, the Application string explicitly identifies the platform: “Microsoft Excel” for Windows versus “Microsoft Excel for Mac” for macOS. Second, the version numbering scheme differs — Windows uses a four-digit build number (e.g., 16.0300) while Mac uses a simpler two-part version (e.g., 16.89). Third, Mac Excel often leaves the Company and Manager fields empty even when these are configured on Windows, because Mac Excel does not pull organizational data from Active Directory or Group Policy.

Forensic Implication

The application fingerprint is valuable for forensic timeline reconstruction. If a file was originally created on Windows (indicated by “Microsoft Excel”) but the last-saved application is “Microsoft Excel for Mac,” you can establish that the file was transferred between platforms. Combined with timestamp analysis, this can help determine when and how a document moved between systems.

Document Inspector: Feature Gap

The Document Inspector is Excel's built-in tool for finding and removing metadata before sharing. On Windows, it is accessed via File → Info → Check for Issues → Inspect Document. On Mac, it is accessed via Tools → Protect Document or the Review tab, depending on the version.

The Windows version of Document Inspector is significantly more thorough. It checks for more categories of hidden data and provides more granular removal options. Here is a comparison of the inspection categories available on each platform.

Inspection Category	Windows	Mac
Comments and annotations	✓	✓
Document properties and personal info	✓	✓
Hidden rows and columns	✓	✓
Hidden worksheets	✓	✓
Headers and footers	✓	Partial
Custom XML data	✓	✗
Invisible content (objects)	✓	✗
Data model and PowerPivot	✓	✗
Content add-ins and task panes	✓	✗
PivotTable cache data	✓	Partial
Embedded documents (OLE)	✓	✗
Defined names	✓	✗

Critical Gap for Mac Users

Mac users relying solely on Document Inspector may be unknowingly sharing files with custom XML data, invisible objects, embedded OLE documents, and defined names that were never inspected or removed. If you work primarily on Mac and need to share files externally, consider running Document Inspector on a Windows machine or using a dedicated metadata removal tool that covers all categories.

Timestamp Behavior and Time Zone Handling

Excel stores creation and modification timestamps in docProps/core.xml using the dcterms:created and dcterms:modified fields. Both platforms write these timestamps in UTC (Coordinated Universal Time) format as ISO 8601 strings. However, there are subtle differences in precision and behavior.

Windows Timestamp Precision

Windows Excel typically writes timestamps with second-level precision and a trailing “Z” for UTC designation: 2026-03-15T14:32:07Z. The timestamp updates every time the file is saved. Windows also stores an NTFS file system timestamp independently, which can be compared against the internal XML timestamp for forensic analysis.

Mac Timestamp Precision

Mac Excel also writes UTC timestamps, but some versions have been observed to write with lower precision or to omit seconds in certain save paths. Additionally, macOS file system timestamps (HFS+ or APFS) use a different epoch and resolution than NTFS, meaning the file system metadata and the internal XML metadata may show slight differences that are normal on Mac but would be suspicious on Windows.

A common cross-platform issue arises with AutoRecover files. On Windows, AutoRecover saves go to %AppData%\Microsoft\Excel\ and update the internal modification timestamp. On Mac, AutoRecover saves go to ~/Library/Containers/com.microsoft.Excel/Data/Library/Preferences/AutoRecovery/. If a crash recovery occurs on one platform after the file was last manually saved on the other, the timestamp chain can show an unexpected platform switch that is actually just a recovery artifact.

File System Metadata: Beyond the XLSX Container

In addition to the metadata stored inside the XLSX file, the operating system adds its own metadata layer. These file system properties are not part of the Excel file format but travel with the file on the same system and can sometimes persist through file transfers.

Windows (NTFS)

Alternate Data Streams (ADS): NTFS can attach hidden data streams to files, such as the Zone.Identifier that marks files downloaded from the internet.
Owner SID: The file owner is recorded as a Windows Security Identifier tied to the user or service account.
Encryption (EFS): NTFS-level encryption metadata may be present if the file was encrypted at the file system level.
Extended Properties: NTFS stores a rich set of extended properties (title, subject, tags) that Windows Explorer can display and edit independently of Excel's internal metadata.

macOS (APFS/HFS+)

Extended Attributes (xattr): macOS uses extended attributes for quarantine flags (com.apple.quarantine), download source URLs, and Finder metadata.
Spotlight Metadata: macOS indexes file content and properties for Spotlight search, creating a separate metadata cache that persists until the index is rebuilt.
Resource Forks: Legacy from HFS+, resource forks can carry additional data. Modern macOS rarely uses them, but old files may still have them.
Finder Info: Tags, colors, and custom Finder labels are stored as extended attributes and are not visible inside the XLSX file.

Cross-Platform Transfer Impact

Most file system metadata is stripped when files move between platforms. Emailing an XLSX file from Mac to Windows removes macOS extended attributes and vice versa. However, some transfer methods preserve more than expected: AirDrop between Macs preserves xattrs, SMB shares between Mac and Windows can map certain attributes, and cloud sync services like OneDrive may cache and restore platform-specific metadata when the file returns to its original platform.

VBA and Macro Metadata Differences

Excel files containing macros (XLSM format) carry additional metadata within the VBA project. The differences between Mac and Windows in this area are significant because the VBA engines are distinct implementations.

VBA Project Properties

On Windows, the VBA project stores the project name, description, help file path, and conditional compilation arguments. These fields are editable in the VBA Editor under Tools → Properties. On Mac, the same fields exist but the VBA Editor interface is more limited, and some users inadvertently leave default values that differ from the Windows defaults.

Reference Libraries

VBA projects reference external libraries, and these references are stored as metadata. A Windows-created macro might reference C:\Windows\System32\scrrun.dll (the Scripting Runtime), while the same functionality on Mac references a different path or may not be available at all. These broken references are embedded in the file and visible to anyone who opens the VBA Editor.

Digital Signatures

VBA project digital signatures work differently on each platform. Windows supports Authenticode-based signing through the Windows certificate store. Mac supports signing but uses the macOS Keychain. A macro signed on one platform may show as unsigned or have a broken signature on the other, which changes the trust metadata associated with the file.

Platform-Exclusive Features and Their Metadata

Several Excel features exist only on Windows or have significantly different implementations on Mac. Files that use these features carry metadata that the other platform may not be able to inspect, display, or remove.

PowerQuery (Windows Only)

PowerQuery stores data connection strings, transformation steps (M code), query names, and source file paths inside the XLSX file. These can reveal internal server names, database credentials, file share paths, and data source locations. Mac Excel cannot create or edit PowerQuery queries, and its Document Inspector does not scan for this metadata category. A file created with PowerQuery on Windows and shared with a Mac user will still contain all connection metadata — the Mac user just cannot see or remove it through the UI.

PowerPivot Data Models (Windows Only)

PowerPivot embeds an entire data model inside the XLSX file, often containing imported data from external sources. This embedded data can include rows that are not visible in any worksheet. Mac Excel can display PivotTables connected to a data model but cannot edit the model or inspect its contents. The data model metadata — including table definitions, relationships, DAX measures, and source data — remains in the file when shared with Mac users.

COM Add-ins (Windows Only)

Windows COM add-ins can inject metadata into the app.xml properties or into custom XML parts. These add-in artifacts persist in the file even after the add-in is uninstalled. Mac Excel uses a different add-in architecture and will not generate the same artifacts, but it also cannot detect or clean up COM add-in metadata left by Windows.

AppleScript Integration (Mac Only)

Mac Excel supports AppleScript automation, and files processed by AppleScript workflows may carry metadata about the automation environment. While AppleScript itself does not embed metadata into the XLSX file, automated workflows often modify the lastModifiedBy field to reflect the system user running the script rather than the original author.

Practical Recommendations for Cross-Platform Teams

If your organization uses a mix of Mac and Windows machines, these practices will help you maintain consistent metadata hygiene across both platforms.

Standardize Metadata Removal on Windows

Because Windows Document Inspector covers more categories than Mac, designate a Windows machine as the final metadata check station before external sharing. Run Document Inspector on Windows after all edits are complete, regardless of which platform was used for editing.

Use a Platform-Agnostic Metadata Tool

Tools like MetaData Analyzer, python-docx, or openpyxl inspect the raw XML inside the XLSX container and are not limited by either platform's UI. Running a cross-platform metadata analysis tool ensures nothing is missed.

Align Author Names Across Platforms

Ensure all team members sign into the same Microsoft 365 account on both Mac and Windows. This prevents author name mismatches that look suspicious in audits. Check File → Account on both platforms to verify the displayed name.

Document Your Platform Mix

For compliance and forensic readiness, maintain a record of which platforms and Excel versions are in use across your organization. When metadata anomalies arise, this documentation helps distinguish normal cross-platform artifacts from genuine tampering indicators.

Test Your Sharing Workflow on Both Platforms

Create a test file with known metadata on one platform, run your metadata removal process, then open the cleaned file on the other platform and inspect it. This end-to-end test reveals platform-specific metadata that your current process might miss.

Common Cross-Platform Pitfalls

“I cleaned it on Mac, so it's safe to share”

Mac Document Inspector misses several metadata categories that Windows Document Inspector covers. If the file was originally created on Windows with PowerQuery connections, COM add-in artifacts, or custom XML data, the Mac cleaning pass will not remove them. The file may still contain internal server paths, database names, or organizational data.

“The author name changed — someone tampered with it”

Not necessarily. Cross-platform editing routinely causes the lastModifiedBy field to change format because Mac and Windows resolve the username differently. Before concluding tampering, check whether the file was edited on a different platform by examining the application fingerprint in app.xml.

“The version number looks wrong — is this a pirated copy?”

Mac and Windows use entirely different version numbering. A Windows AppVersion of 16.0300 and a Mac AppVersion of 16.89 both represent legitimate, current versions of Excel. Do not flag version number differences as anomalies unless you are comparing within the same platform.

“The Company field is blank — this must be personal use”

Mac Excel routinely leaves the Company field empty because it does not pull organizational data from Active Directory. A blank Company field is normal for Mac-created files and does not indicate that the file was created outside the organization. Check the author field and application string for more reliable origin clues.

Key Takeaways

Mac and Windows Excel produce files in the same format but with different metadata fingerprints. Understanding these differences prevents false positives in forensic analysis, ensures thorough metadata cleaning regardless of platform, and helps cross-platform teams maintain consistent data hygiene.

Summary

•Application fingerprints differ: Windows writes “Microsoft Excel” while Mac writes “Microsoft Excel for Mac,” with different version numbering schemes. Use this to trace a file's platform history.
•Author names resolve differently: Windows pulls from Active Directory or Microsoft account; Mac pulls from macOS user profile. Cross-platform editing creates legitimate author name mismatches.
•Document Inspector is weaker on Mac: It misses custom XML, invisible objects, embedded documents, COM add-in artifacts, and defined names. Always run the final metadata check on Windows or use a cross-platform tool.
•Windows-only features leave hidden metadata: PowerQuery connections, PowerPivot data models, and COM add-in artifacts persist in files shared with Mac users, who cannot detect or remove them through Excel's UI.
•File system metadata is platform-specific: NTFS alternate data streams, macOS extended attributes, and Spotlight metadata exist outside the XLSX file but can reveal information about where and how the file was used.