Hi everyone,
I have an NSF file that appears to be password protected (I found this out after creating a virtual machine of the drive and attempting to open up Lotus Notes). I have run the email parser within Encase and it parses it, well so it tells me. When I look the file in entries view within Encase it shows up a Lotus volume but it’s all unallocated. I have closed the volume and then used the view file structure option this just gives me the same as the email parser. I have tried to create a logical evidence file of the lotus volume using the file mounter script again nothing. EnCase reports that is has a signature match and in fact is an NSF file and the logical size is 6,386,876,416.
I have copied this file out and loaded it into network email examiner and it informs me that it’s not a database file and attempts to open it but can’t.
Has anyone any ideas about how I can view the contents of this NSF file.
Thanks very much for your help in this matter.
I am wondering if you have the ID file associated with this NSF? Unless I am mistaken you will need this as well as the user's password to decrypt the NSF.
If it is, in fact, encrypted and you do not have access to the ID file and the password that is the end of the matter unless you are very lucky.
How did you come by the .nsf? If the Notes administrators are on your side they may have a copy of the ID file and also have a way to recover the password. It all depends how the system was set up at the begining.
If you have a complete image of the machine you will probably find a copy of the ID file on it.
I have sent you a PM with some other ideas.
As an afterthought don't forget that Notes is a distributed system and you may well find that there is another copy of the .nsf somewhere else on the network that may belong to someone who will give you their password.