ForensicsWiki will continue to operate as it has before and will not be shutting down. Thank you for your continued support of ForensicsWiki.

Difference between revisions of "Notes Storage Facility (NSF)"

From ForensicsWiki
Jump to: navigation, search
(See also)
Line 13: Line 13:
== File types ==
== File types ==
NSF defines a ODS (on-disk structure) version.
NSF defines an on-disk structure (ODS) version.
* 16 (Notes 1.x, 2x)
* 16 (Notes 1.x, 2x)
* 17 (Notes 3.x)
* 17 (Notes 3.x)

Revision as of 07:32, 13 October 2010

Lotus Notes and Domino use the Notes Storage Facility (NSF) database to store e-mails, appointments, tasks, contacts, notes, etc.

MIME types

  • application/x-lotus-notes
  • application/vnd.lotus-notes

File signature

The NSF has the following file signature: hexadecimal: 1a 00 (which is often followed by: 00 04 00 00)

File types

NSF defines an on-disk structure (ODS) version.

  • 16 (Notes 1.x, 2x)
  • 17 (Notes 3.x)
  • 20 (Notes 4.x)
  • 41 (Notes 5.x)
  • 43 (Notes 6, 7 and 8)
  • 48 (Notes 8)
  • 51 (Notes 8.5)

One significant change in the Record Relocation Vector (RRV) seems to be introduced in format revision 22.


The NSF basically is a collection of Notes. A Note in concept is similar to that of an object or item; mainly a container for data and metadata. Notes are used to store a vast variety of items, e.g. emails, documents, appointments, log-entries, data-views, forms, etc.


Notes can use various forms of encryption see: Notes from Support: Notes Encryption - Locks for a Digital World.

See also