nsf files metadata???


blueDragon

New Member
Jul 24, 2007
36
0
#1
Hi all,

Got questions about Lotus Notes' NSF files.

Let say if I had exttracted individual e-mail and attachment from a hdd, then using another machine to create a new container for opening the e-mail and attachment, here's the questions;

1) Will there be any changes to the meta data of the e-mail and attachment I extracted?

2) Any analysis tool to analyse the meta data of nsf files?

3) If I'm going to set up a test bed to test my finding, how should I go about it?

Any suggestion will great!
 

RobertR

New Member
Jun 3, 2007
447
0
#2
Okay.... I was waiting to see if anybody might have some experience with Lotus Notes as I dont..... So I will try to help if I can..... The only approach that I can suggest is what I would so with Files I have not seen before and looking for meta data in them...

My feeling is that extracting the data in the native container should not change the data... the simple way to check is the hash the file before and after the export... if the hashes are the same the files are identical and you meta data will be retained.

To look at the meta data you may end up looking at the file in a hex editor and finding the data that way...... I'm sorry I am not aware of any other tools that could help with that aspect..... What types of meta data are you referring to.... mail headers or something more specific???


News flash........ Paraben's e-mail examiner claims to work with Lotus Notes.... I have used the tool before, it it is pretty nice... but have never used it for Lotus Notes
 

blueDragon

New Member
Jul 24, 2007
36
0
#3
Thanks RobertR,

What I want to prove is that the e-mails' MAC that I move over will not change. (Which as you point out, the hash value did not change.)

I want to get the last accessed, modified and created time and date. I want to confirm that the metadata MAC is the one that created by the original e-mail and not the MAC when I copied the e-mails to another container.
 

RobertR

New Member
Jun 3, 2007
447
0
#4
I think you should be golden..... I assume that NSF files are compound files like most others... the created and accessed times for the master NSF files will be changed, but the times in the mail headers and MTA hops should be retained.
 

avajseph

New Member
Nov 6, 2016
8
0
#5
Make use of this best Lotus Notes to Outlook converter for recovering NSF file and converting NSF file to PST, EML and MSG format with whole versions of Lotus Notes NSF and Outlook file.

Read More: "http://www.lotusnotesnsffileconverter.lotusnotesfileconverter.com/"

Moderator Note: Direct links are not allowed.
 

About us

  • Our community began in 2004. Since this time, we have grown to have over 29,000+ members within the DFIR & Cyber Security community.

    We are happy to announce that this forum is now under new ownership with the goal to once again become the main Digital Forensics Forum on the internet for DFIR, OSINT and Cyber Security.

    If you can think of ways to help us improve, please let us know.

    We pride ourselves on offering unbiased, critical discussion among people of all different backgrounds.

    We are working every day to make sure our community is one of the best.

Quick Navigation

User Menu