Difference between pages "Scalpel" and "Notes Storage Facility (NSF)"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
 
(Fixed broken link with current reference to specified PDF. (Yes, I know it's a Google Drive Link) See Downloads link at http://code.google.com/p/libnsfdb/ to validate)
 
Line 1: Line 1:
{{Infobox_Software |
+
[[Lotus]] [[Notes]] and [[Domino]] use the '''Notes Storage Facility (NSF)''' database to store e-mails, appointments, tasks, contacts, notes, etc.
  name = Scalpel |
+
  maintainer = [[Golden G. Richard III]] and [[Lodovico Marziale]] |
+
  os = {{Linux}}, {{Windows}}, {{Mac OS X}} |
+
  genre = [[Carving]] |
+
  license = {{GPL}} |
+
  website = https://github.com/sleuthkit/scalpel |
+
}}
+
  
'''Scalpel''' is an [[open source]] program for [[recovering deleted data]] originally based on [[foremost]], although significantly more efficient. Originally developed by [[Golden G. Richard III]] and presented at the [[Digital Forensic Research Workshop|DFRWS]] conference in 2005, it allows an examiner to specify a number of headers and footers to recover filetypes from a piece of media.  Scalpel is maintained by [[Golden G. Richard III]] and [[Lodovico Marziale]].  Currently, Scalpel is being incorporated into the [[Sleuthkit]] (TSK) and is now hosted on GitHub.
+
== MIME types ==
  
== External Links ==
+
* application/x-lotus-notes
 +
* application/vnd.lotus-notes
  
* [http://dfrws.org/2005/proceedings/richard_scalpel.pdf Scalpel: A frugal, high-performance file carver] from the Proceedings of the 2005 [[Digital Forensic Research Workshop]]
+
== File signature ==
 +
 
 +
The NSF has the following file signature:
 +
hexadecimal: 1a 00 (which is often followed by: 00 04 00 00)
 +
 
 +
== File types ==
 +
 
 +
NSF defines an on-disk structure (ODS) version.
 +
* 16 (Notes 1.x, 2x)
 +
* 17 (Notes 3.x)
 +
* 20 (Notes 4.x)
 +
* 41 (Notes 5.x)
 +
* 43 (Notes 6, 7 and 8)
 +
* 48 (Notes 8)
 +
* 51 (Notes 8.5)
 +
 
 +
One significant change in the Record Relocation Vector (RRV) seems to be introduced in format revision 22.
 +
 
 +
== Contents ==
 +
 
 +
The NSF basically is a collection of '''Notes'''. A '''Note''' in concept is similar to that of an object or item; mainly a container for data and metadata. '''Notes''' are used to store a vast variety of items, e.g. emails, documents, appointments, log-entries, data-views, forms, etc.
 +
 
 +
== Encryption ==
 +
 
 +
Notes can use various forms of encryption see: [http://www.ibm.com/developerworks/lotus/library/ls-Notes_Encryption/index.html Notes from Support: Notes Encryption - Locks for a Digital World].
 +
 
 +
== See also==
 +
 
 +
* [http://www-12.lotus.com/ldd/doc/tools/c/7.0/api70ref.nsf Lotus C API Notes/Domino 7.0 Reference]
 +
* [http://en.wikipedia.org/wiki/Notes_Storage_Format Wikipedia IBM Lotus Notes]
 +
* [https://googledrive.com/host/0B3fBvzttpiiSbkI4d1pRQmdMNWc/Notes%20Storage%20Facility%20(NSF)%20database%20file%20format.pdf Notes Storage Facility (NSF) database file format.pdf], by the [[libnsfdb|libnsfdb project]], February 2010
 +
 
 +
[[Category:File Formats]]

Latest revision as of 09:00, 13 February 2014

Lotus Notes and Domino use the Notes Storage Facility (NSF) database to store e-mails, appointments, tasks, contacts, notes, etc.

MIME types

  • application/x-lotus-notes
  • application/vnd.lotus-notes

File signature

The NSF has the following file signature: hexadecimal: 1a 00 (which is often followed by: 00 04 00 00)

File types

NSF defines an on-disk structure (ODS) version.

  • 16 (Notes 1.x, 2x)
  • 17 (Notes 3.x)
  • 20 (Notes 4.x)
  • 41 (Notes 5.x)
  • 43 (Notes 6, 7 and 8)
  • 48 (Notes 8)
  • 51 (Notes 8.5)

One significant change in the Record Relocation Vector (RRV) seems to be introduced in format revision 22.

Contents

The NSF basically is a collection of Notes. A Note in concept is similar to that of an object or item; mainly a container for data and metadata. Notes are used to store a vast variety of items, e.g. emails, documents, appointments, log-entries, data-views, forms, etc.

Encryption

Notes can use various forms of encryption see: Notes from Support: Notes Encryption - Locks for a Digital World.

See also