Find Every External Link and Data Connection in an Excel Workbook

A workbook with one external reference and one hyperlink

The most common audit result: a model that pulls one figure from another workbook and has a docs hyperlink in a cell. Both surface, each on its own typed line.

Report:
Found 2 external link(s):

1. [external_ref] file:///C:/Finance/Models/Forecast-2025.xlsx
2. [hyperlink] https://intranet.example.com/runbook

A clean, self-contained workbook

When none of the three scanned parts contain a target, the report is a single line. This is the result you want before shipping a file externally.

Report:
No external links found in this workbook.

A workbook with a Power Query / ODBC data connection

Data connections live in xl/connections.xml. The scan reads both the connection= string and any odcFile= reference, each emitted as a data_connection line.

Report:
Found 1 external link(s):

1. [data_connection] Provider=Microsoft.ACE.OLEDB.12.0;Data Source=\\server\share\sales.accdb

Several stale network-share references

A model consolidated from departmental files often carries many external_ref targets to a UNC path. Each relationship target is listed individually so you can see the full blast radius.

Report:
Found 3 external link(s):

1. [external_ref] file:///\\fileserver\dept\budget-east.xlsx
2. [external_ref] file:///\\fileserver\dept\budget-west.xlsx
3. [external_ref] file:///\\fileserver\dept\budget-central.xlsx

Audit, remediate, re-audit (the full loop)

The tool reports; Excel removes. Break the links in Excel, then re-run the auditor to confirm the file is now clean before signing off.

Pass 1 (before):
Found 2 external link(s):
1. [external_ref] file:///C:/old/source.xlsx
2. [hyperlink] file:///\\server\share\notes.docx

In Excel: Data > Edit Links > Break Link; delete the cell hyperlink.

Pass 2 (after):
No external links found in this workbook.

The scan reads relationship targets in xl/externalLinks/_rels/*.rels, not formula text in worksheet XML. In a well-formed workbook, every external workbook reference has a backing externalLinks relationship, so it is detected. But the auditor does not parse formula strings character-by-character, so a hand-edited or malformed file that carries a [Other.xlsx] token without the corresponding relationship part would not surface. Re-save in Excel to regenerate the relationships, then re-audit.

The report lists each link's type and target URL only — it does not tell you which cell or sheet the link sits in. To locate an external_ref in Excel, use Ctrl+F and search the file token (e.g. [Forecast.xlsx]); for a hyperlink, scan the sheet the relationship belongs to. The tool's job is to prove a link exists and what it points at, not to map it to a cell.

.xlsb is a binary-XML format and .xls is a legacy OLE compound file — neither is a standard OOXML ZIP container, so JSZip cannot unpack them into the XML parts the scan expects. Open the file in Excel and Save As → Excel Workbook (.xlsx) first.

Hyperlinks attached to shapes/images live in xl/drawings/_rels/*.rels, and OLE/embedded-object targets live elsewhere — these parts are outside the three the scan reads. The auditor covers cell hyperlinks, workbook references, and data connections. For embedded-object hygiene before sharing, pair this with the Comment & Note Purger and VBA Macro Stripper.

A workbook protected with File → Info → Protect Workbook → Encrypt with Password is an encrypted OLE container, not a readable ZIP, so JSZip cannot open it and no parts can be scanned. Remove the open-password in Excel first, then audit. To assess password strength separately, see the Password Entropy Auditor.

Detection is keyed to relationship parts, not to cell usage. One externalLinks relationship to Forecast.xlsx produces one external_ref line even if 50 cells pull from that workbook. The report tells you which external files are referenced, not how many cells use each — that is the correct granularity for an audit.

A named range like =[Rates.xlsx]Sheet1!$A$1 still requires an externalLinks relationship in the package, so the underlying external_ref target appears in the report. The auditor surfaces the external file; the named-range wiring itself is not separately labelled. To trace where a named range is consumed, use the Dependency Map.

Any relationship whose Type contains hyperlink is reported, including mailto: addresses and external file paths. In-workbook navigation links (location-only, with no external relationship Target) are not relationship-backed and so do not appear — only relationships carrying a real Target are listed.

Pro accepts up to 50 MB and Developer up to 500 MB. A consolidated model above your cap is rejected before scanning. Large workbooks are often bloated by embedded media or cached external data — run the Workbook Weight Analyzer to see the external_links byte share, then trim and re-audit.

If xl/externalLinks/, the worksheet _rels hyperlink relationships, and xl/connections.xml are all absent or empty, the report is No external links found in this workbook. This is the definitive clean result — the file is self-contained and safe to distribute on that axis.