Create an account Home  ·  Topics  ·  Downloads  ·  Your Account  ·  Submit News  ·  Top 10  
Modules
· Home
· Content
· FAQ
· Forensic Downloads
· Forensics Feedback
· Forums
· Members List
· Statistics
· Surveys
· Top 10
· Topics
· Training Reviews
· Web Links
· Your Account

Our Membership

Latest: williamlucas
New Today: 0
New Yesterday: 0
Overall: 29661

Computer Forensics
This is a free and open peer to peer medium for digital and computer forensics professionals and students. Please help us maintain it by contributing and perhaps linking to us from your own website.

Recent Posts

 Puma Suede zapatos compactos a menudo usan esas sutilezas
 Software to search an FTK Lite Mounted drive with keyword
 How much can be found?
 Computer Forensic in responding to Data Breach issues
 A bunch of numbers about digital evidences collection

Computer Forensics World Forums


Pages Served
We received
59540489
page views since August 2004

Security Sources

FTC
OnGuard Online
ISO 17799 ISO 27001
ISO 27000 Toolkit
ISO 27001 & 27000
Cryptography
Security Policies

Computer Forensics World: Forums

Computer Forensics World :: View topic - nsf files metadata???
 Forum FAQForum FAQ   SearchSearch   UsergroupsUsergroups   ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 

nsf files metadata???

 
Post new topic   Reply to topic    Computer Forensics World Forum Index -> Technical Issues
View previous topic :: View next topic  
Author Message
blueDragon
Newbie
Newbie


Joined: Jul 25, 2007
Posts: 12

PostPosted: Tue Oct 02, 2007 1:39 pm    Post subject: nsf files metadata??? Reply with quote

Hi all,

Got questions about Lotus Notes' NSF files.

Let say if I had exttracted individual e-mail and attachment from a hdd, then using another machine to create a new container for opening the e-mail and attachment, here's the questions;

1) Will there be any changes to the meta data of the e-mail and attachment I extracted?

2) Any analysis tool to analyse the meta data of nsf files?

3) If I'm going to set up a test bed to test my finding, how should I go about it?

Any suggestion will great!
Back to top
View user's profile
RobertR
Newbie
Newbie


Joined: Jun 04, 2007
Posts: 149
Location: Arizona

PostPosted: Sat Oct 06, 2007 3:38 am    Post subject: Reply with quote

Okay.... I was waiting to see if anybody might have some experience with Lotus Notes as I dont..... So I will try to help if I can..... The only approach that I can suggest is what I would so with Files I have not seen before and looking for meta data in them...

My feeling is that extracting the data in the native container should not change the data... the simple way to check is the hash the file before and after the export... if the hashes are the same the files are identical and you meta data will be retained.

To look at the meta data you may end up looking at the file in a hex editor and finding the data that way...... I'm sorry I am not aware of any other tools that could help with that aspect..... What types of meta data are you referring to.... mail headers or something more specific???


News flash........ Paraben's e-mail examiner claims to work with Lotus Notes.... I have used the tool before, it it is pretty nice... but have never used it for Lotus Notes
Back to top
View user's profile
blueDragon
Newbie
Newbie


Joined: Jul 25, 2007
Posts: 12

PostPosted: Tue Oct 09, 2007 11:19 am    Post subject: Reply with quote

Thanks RobertR,

What I want to prove is that the e-mails' MAC that I move over will not change. (Which as you point out, the hash value did not change.)

I want to get the last accessed, modified and created time and date. I want to confirm that the metadata MAC is the one that created by the original e-mail and not the MAC when I copied the e-mails to another container.
Back to top
View user's profile
RobertR
Newbie
Newbie


Joined: Jun 04, 2007
Posts: 149
Location: Arizona

PostPosted: Wed Oct 10, 2007 4:12 am    Post subject: Reply with quote

I think you should be golden..... I assume that NSF files are compound files like most others... the created and accessed times for the master NSF files will be changed, but the times in the mail headers and MTA hops should be retained.
Back to top
View user's profile
avajseph
Newbie
Newbie


Joined: Nov 07, 2016
Posts: 2

PostPosted: Mon Nov 07, 2016 8:09 pm    Post subject: Reply with quote

Make use of this best Lotus Notes to Outlook converter for recovering NSF file and converting NSF file to PST, EML and MSG format with whole versions of Lotus Notes NSF and Outlook file.

Read More: "http://www.lotusnotesnsffileconverter.lotusnotesfileconverter.com/"

Moderator Note: Direct links are not allowed.
Back to top
View user's profile
Display posts from previous:   
Post new topic   Reply to topic    Computer Forensics World Forum Index -> Technical Issues All times are GMT + 10 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

Powered by phpBB 2.0.10 © 2001 phpBB Group
phpBB port v2.1 based on Tom Nitzschner's phpbb2.0.6 upgraded to phpBB 2.0.4 standalone was developed and tested by:
ArtificialIntel, ChatServ, mikem,
sixonetonoffun and Paul Laudanski (aka Zhen-Xjell).

Version 2.1 by Nuke Cops 2003 http://www.nukecops.com

Forums ©

 

TMs property of their respective owner. Comments property of posters. 2007 Computer Forensics Science World.
Digital forensic computing news syndication: Computer Forensics Training News or UM Text
Software is copyrighted phpnuke.org (c)2003, and is free under licence agreement. All Rights Are Reserved.