Is there anyone that previously investigated Lotus Notes .NSF mailbox files in Magnet Axiom?
Conducting a second opinion case on an email investigation. Looking at the report of the previous DFIR company, it is stated that they conducted the investigation completely in Magnet Axiom.
As far as i am aware, .NSF files are not supported by Magnet Axiom and also the tests i have run on Magnet Axiom failed. The files can not even be selected as a source within Axiom.
So a little mistery here. But maybe they converted the file to a PST file or used some other work around i am unaware of, however it is not mentioned anywhere in the report.
Thanks and cheers!
I wish I was on earlier to answer this. Â
Those are not the best solutions as I'm not sure what MetaData comes through the conversation process, bit if content is all then they are a solution. Â
Am sure the AXIOM Magnet people have it on a to-do list somewhere. Â
One solution (sort of) is have the Domino server publish the database as http then use an HTTP stripper con convert it to disk html.Â
Dale
Hi Dale,
Thank you for your feedback.
The case itself has been closed already but indeed the first examination was done by trying to convert to pst files. Comparison with an email forensic suite that was capable of processing .NSF files learned that a lot of data was lost during the conversion, not just metadata but also email messages.
Rg,
Lex
Â
