Thanks Joachimm, your documentation is very interesting.
Noprob; but for CF-purposes note that it is a work-in-progress. If anyone has additions/alterations regarding the document don't hesitate to drop me PM or contact me through the project site.
PS By the way, Lotus Notes is a wonderful system, don't listen to the detractors.
Hopefully by opening up the file format it will also reduce some of the FUD often related to Notes.
Hi,
Just a quick pointer, When doing a collection of Notes NSF Files, you should request from the IT person in charge of the environment is there any compacting of mail boxes running on the domino server. I carried out some testing on some nsf mail boxes. If I delete mails form an NSF Mail box and then compact the mailbox on the server I will will loose some of the the deleted mails.
You may want to estibilish the backup environment of the suspect premises.
Hope this helps.
James
I can only speak from my personal experience.
PST to MSG… I use dtSearch's mapitool.
As for NSF to MSG, so far I have been most successful using NSF to PST to MSG, I have yet to find a good (stable) solution to do this NSF to MSG conversion.
I have used 'Transend Migrator Forensic' with the some success for both PST and NSF.
Agreed, metadata is altered, directory/folder structure lost, and some attachments get mangled. but, in my experience for most discovery, the purpose of conversion of, say 2 million messages is to find the dozen which is relevant, and then go back to the original and extract only those originals with the appropriate headers and intact metadata.
I would love to say that my work involves cutting edge forensics; alas almost all cases revolve around e-mail content, with little need to do forensics. Yes, the drudgery of indexing gobs and gobs of meeting notes is where electronic discovery 'shines'.
I collect both PSTs and NSFs then dump them into MSGs for indexing, by the millions. cry
In my experience about 2/3rds of the time the problems are with the NSF extracts, not the PST.
Part of the problem is probably that PST -> MSG remains MAPI (no conversion) and NSF -> MSG needs conversion. Personally I'm reluctant to such conversions because you'll alter the metadata, but I also know that sometimes you (in general) have little other choice.
Another part might be that the tool(s) you are using has a limited or broken support for NSF. I was often amazed to find the only tool capable to read certain NSF files is Notes itself. But I also have seen semi-corrupted-PST files created by Exmerge not being opened by any tool. For which I had to cook up something in libpff.
Note that both PST and NSF are complex database formats. Although if you put them in comparison the latter might be the more complex due to more capabilities. Where PST uses a lot of external COM objects, NSF mostly has the functionality embedded.
I collect both PSTs and NSFs then dump them into MSGs for indexing
What tools do you use to get from .nsf to .msg?
I would love to say that my work involves cutting edge forensics; alas almost all cases revolve around e-mail content, with little need to do forensics.
Note that cutting-edge quite easily can turn into bleeding-edge 😉