±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 0 Overall: 36632
New Yesterday: 3 Visitors: 116

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Outlook Email SQLite DB files from APFS formated MacBook

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts

Senior Member

Outlook Email SQLite DB files from APFS formated MacBook

Post Posted: Sep 20, 18 23:25

Hello all,

I am analyzing an APFS formatted physical forensic image of a MacBook.

There are several juicy SQLite database files located at /Users/"UserName"/Library/Group Containers/#########.Office/Outlook:


However, the SQLite files appear to be encrypted as I cannot extract text nor open these files using multiple different forensic tools.

** Are these files all encrypted? If so, any clues on how to decrypt or if decryption is even possible??  

Page 1 of 1