Join Us!

Outlook Email SQLit...
 
Notifications
Clear all

Outlook Email SQLite DB files from APFS formated MacBook  

  RSS
UnallocatedClusters
(@unallocatedclusters)
Senior Member

Hello all,

I am analyzing an APFS formatted physical forensic image of a MacBook.

There are several juicy SQLite database files located at /Users/"UserName"/Library/Group Containers/#########.Office/Outlook

Outlook.sqlite
Outlook.sqlite.shm
Outlook.sqlite-wal
Outlook.sqlite.bak

However, the SQLite files appear to be encrypted as I cannot extract text nor open these files using multiple different forensic tools.

** Are these files all encrypted? If so, any clues on how to decrypt or if decryption is even possible??

Quote
Posted : 21/09/2018 12:25 am
Share: