±Forensic Focus Partners
±Your Account

![]() |
![]() |
![]() |
![]() |
±Latest Articles
±Latest Jobs
±Latest Webinars
Back to top
Skip to content
Skip to menu
Back to top
Back to main
Skip to menu
Outlook Email SQLite DB files from APFS formated MacBook
Outlook Email SQLite DB files from APFS formated MacBook
Posted: Thu Sep 20, 2018 5:25 pm
Hello all,
I am analyzing an APFS formatted physical forensic image of a MacBook.
There are several juicy SQLite database files located at /Users/"UserName"/Library/Group Containers/#########.Office/Outlook:
Outlook.sqlite
Outlook.sqlite.shm
Outlook.sqlite-wal
Outlook.sqlite.bak
However, the SQLite files appear to be encrypted as I cannot extract text nor open these files using multiple different forensic tools.
** Are these files all encrypted? If so, any clues on how to decrypt or if decryption is even possible??
I am analyzing an APFS formatted physical forensic image of a MacBook.
There are several juicy SQLite database files located at /Users/"UserName"/Library/Group Containers/#########.Office/Outlook:
Outlook.sqlite
Outlook.sqlite.shm
Outlook.sqlite-wal
Outlook.sqlite.bak
However, the SQLite files appear to be encrypted as I cannot extract text nor open these files using multiple different forensic tools.
** Are these files all encrypted? If so, any clues on how to decrypt or if decryption is even possible??
-
UnallocatedClusters - Senior Member