±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 3 Overall: 35388
New Yesterday: 4 Visitors: 146

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

Outlook Email SQLite DB files from APFS formated MacBook

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

UnallocatedClusters
Senior Member
 

Outlook Email SQLite DB files from APFS formated MacBook

Post Posted: Sep 20, 18 17:25

Hello all,

I am analyzing an APFS formatted physical forensic image of a MacBook.

There are several juicy SQLite database files located at /Users/"UserName"/Library/Group Containers/#########.Office/Outlook:

Outlook.sqlite
Outlook.sqlite.shm
Outlook.sqlite-wal
Outlook.sqlite.bak

However, the SQLite files appear to be encrypted as I cannot extract text nor open these files using multiple different forensic tools.

** Are these files all encrypted? If so, any clues on how to decrypt or if decryption is even possible??  
 

Page 1 of 1