±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36768
New Yesterday: 0 Visitors: 78

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Lotus Notes Collection

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page Previous  1, 2, 3, 4  Next 
  

joachimm
Senior Member
 

Re: Lotus Notes Collection

Post Posted: Nov 08, 10 23:57

I cannot recall IBM terminating NSFDB2 support
www-01.ibm.com/support...wg21384421

According to this link they are supporting it until 2017.

Note that I did some work on the NSF file format.
sourceforge.net/projects/libnsfdb/

This work is focussed on the NSF file format not on the Notus/Domino product.
It is far from complete because NSF is a complex and versatile file format.
However the references could provide you some background information.

Buster, note that in light of this project, I'm also interested in your old notes; BTW was this an intended pun?  
 
  

roncufley
Senior Member
 

Re: Lotus Notes Collection

Post Posted: Nov 09, 10 03:22

- Buster


Is this separate database just another series of NSF files or is it in a different file format


From memory, they will be in NSF format although around v7, IBM added the ability to use DB2 as an alternative (NSFDB2) although I believe this is now deprecated and no longer supported.


As I understand it, NSFDB2 is on "maintenance only" so no further development.

Yes, the Single Copy Object Store is a single .nsf file which is always (I think) encrypted and can only be accessed by the server that created it or, at least, using the server's .ID file. As an aside the servers' .ID files are almost never password protected so if you have physical access to the .nsf and the server .ID you can read the .nsf.

- Buster
I also seem to remember a set of files called "MAIL.BOX" which were relevant (on the server side) but I can' t recall why off the top of my head.


The mail.box is the router mailbox which is used to hold the mail before the mail servers replicate and to hold the mail before it is delivered to the recipient's mail file. It was also used to hold outgoing mail on the client awaiting the next connection with the server.
_________________
Forensic Computer Services
Digital Forensics and eDiscovery
Lotus Notes eDiscovery and Forensics
CCTV Forensics and analysis
Tape eDiscovery and Forensics 
 
  

jhup
Senior Member
 

Re: Lotus Notes Collection

Post Posted: Nov 09, 10 07:15

I collect both PSTs and NSFs then dump them into MSGs for indexing, by the millions. Crying or Very sad

In my experience about 2/3rds of the time the problems are with the NSF extracts, not the PST.  
 
  

roncufley
Senior Member
 

Re: Lotus Notes Collection

Post Posted: Nov 09, 10 13:51

- jhup
I collect both PSTs and NSFs then dump them into MSGs for indexing


What tools do you use to get from .nsf to .msg?
_________________
Forensic Computer Services
Digital Forensics and eDiscovery
Lotus Notes eDiscovery and Forensics
CCTV Forensics and analysis
Tape eDiscovery and Forensics 
 
  

joachimm
Senior Member
 

Re: Lotus Notes Collection

Post Posted: Nov 09, 10 13:57

- jhup
I collect both PSTs and NSFs then dump them into MSGs for indexing, by the millions. Crying or Very sad

In my experience about 2/3rds of the time the problems are with the NSF extracts, not the PST.


Part of the problem is probably that PST -> MSG remains MAPI (no conversion) and NSF -> MSG needs conversion. Personally I'm reluctant to such conversions because you'll alter the metadata, but I also know that sometimes you (in general) have little other choice.

Another part might be that the tool(s) you are using has a limited or broken support for NSF. I was often amazed to find the only tool capable to read certain NSF files is Notes itself. But I also have seen semi-corrupted-PST files created by Exmerge not being opened by any tool. For which I had to cook up something in libpff.

Note that both PST and NSF are complex database formats. Although if you put them in comparison the latter might be the more complex due to more capabilities. Where PST uses a lot of external COM objects, NSF mostly has the functionality embedded.  
 
  

roncufley
Senior Member
 

Re: Lotus Notes Collection

Post Posted: Nov 09, 10 14:01

- joachimm
Note that I did some work on the NSF file format.
sourceforge.net/projects/libnsfdb/


Thanks Joachimm, your documentation is very interesting.
_________________
Forensic Computer Services
Digital Forensics and eDiscovery
Lotus Notes eDiscovery and Forensics
CCTV Forensics and analysis
Tape eDiscovery and Forensics 
 
  

joachimm
Senior Member
 

Re: Lotus Notes Collection

Post Posted: Nov 09, 10 16:22

- roncufley
Thanks Joachimm, your documentation is very interesting.


Noprob; but for CF-purposes note that it is a work-in-progress. If anyone has additions/alterations regarding the document don't hesitate to drop me PM or contact me through the project site.

- roncufley
PS By the way, Lotus Notes is a wonderful system, don't listen to the detractors.


Hopefully by opening up the file format it will also reduce some of the FUD often related to Notes.  
 

Page 3 of 4
Page Previous  1, 2, 3, 4  Next