Difference between pages "Mac OS X" and "Nickfile (NK2)"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
(Quarantine event database)
 
 
Line 1: Line 1:
{{Expand}}
+
[[Microsoft]] [[Outlook]] uses the '''Nickfile (NK2)''' to store e-mail address aliases.
  
Apple Inc.'s Macintosh OS X (pronounced "'''OS Ten'''") is the operating system distributed with Apple computers. It includes heavily used several programs by default, including [[Apple Mail]], a web browser called [[Apple Safari | Safari]], and an [[Apple Address Book]], and [[iCal]].  
+
The file type is also known as the Outlook AutoComplete File or the Nickname file.
  
== Quarantine event database ==
+
== MIME types ==
See [http://menial.co.uk/blog/2011/06/16/mac-quarantine-event-database/]
+
  
Snow Leopard and earlier
+
The actual mime type of the NK2 format is unspecified
<pre>
+
/Users/$USER/Library/Preferences/com.apple.LaunchServices.QuarantineEvents
+
</pre>
+
  
Lion and later
+
== File signature ==
<pre>
+
/Users/$USER/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2
+
</pre>
+
  
== Package Files (.PKG) ==
+
The NK2 has the following file signature:
Package Files (.PKG) are XAR archives [http://en.wikipedia.org/wiki/Xar_(archiver)] that contain a cpio archive and metadata [http://s.sudre.free.fr/Stuff/Ivanhoe/FLAT.html].
+
hexadecimal: 0D F0 AD BA
  
== Also see ==
+
Note that other sources claim that the file signature is
* [[MacOS Process Monitoring]]
+
hexadecimal: 0D F0 AD BA 0A 00 00 00
* [[Acquiring a MacOS System with Target Disk Mode]]
+
  
== External Links ==
+
== Contents ==
  
* [http://www.apple.com/macosx/ Official website]
+
The NK2 basically contains a list of items. The attributes of these items are defined by the [[Microsoft]] [[Outlook]] [[Message API (MAPI)]].
* [http://en.wikipedia.org/wiki/OS_X Wikipedia entry on OS X]
+
* [http://menial.co.uk/blog/2011/06/16/mac-quarantine-event-database/ Quarantine event database]
+
  
[[Category:Mac OS X]]
+
== See also==
[[Category:Operating systems]]
+
 
 +
* A great deal of information about the format has been documented by the [http://libnk2.sourceforge.net libnk2 project], including some of the [http://downloads.sourceforge.net/libnk2/Nickfile_format.pdf Nickfile format specifications] and [http://downloads.sourceforge.net/libpff/MAPI_definitions.pdf MAPI definitions].
 +
 
 +
[[Category:File Formats]]

Revision as of 04:43, 31 January 2009

Microsoft Outlook uses the Nickfile (NK2) to store e-mail address aliases.

The file type is also known as the Outlook AutoComplete File or the Nickname file.

MIME types

The actual mime type of the NK2 format is unspecified

File signature

The NK2 has the following file signature: hexadecimal: 0D F0 AD BA

Note that other sources claim that the file signature is hexadecimal: 0D F0 AD BA 0A 00 00 00

Contents

The NK2 basically contains a list of items. The attributes of these items are defined by the Microsoft Outlook Message API (MAPI).

See also