ForensicsWiki will continue to operate as it has before and will not be shutting down. Thank you for your continued support of ForensicsWiki.

Difference between revisions of "Notes Storage Facility (NSF)"

From ForensicsWiki
Jump to: navigation, search
(See also)
(See also)
Line 36: Line 36:
* [ Lotus C API Notes/Domino 7.0 Reference]
* [ Lotus C API Notes/Domino 7.0 Reference]
* [ Wikipedia IBM Lotus Notes]
* [ Wikipedia IBM Lotus Notes]
* [ Notes Storage Facility (NSF) database file format.pdf]
* [ Notes Storage Facility (NSF) database file format.pdf], by the [[libnsfdb|libnsfdb project]], February 2010
[[Category:File Formats]]
[[Category:File Formats]]

Revision as of 14:51, 12 November 2012

Lotus Notes and Domino use the Notes Storage Facility (NSF) database to store e-mails, appointments, tasks, contacts, notes, etc.

MIME types

  • application/x-lotus-notes
  • application/vnd.lotus-notes

File signature

The NSF has the following file signature: hexadecimal: 1a 00 (which is often followed by: 00 04 00 00)

File types

NSF defines an on-disk structure (ODS) version.

  • 16 (Notes 1.x, 2x)
  • 17 (Notes 3.x)
  • 20 (Notes 4.x)
  • 41 (Notes 5.x)
  • 43 (Notes 6, 7 and 8)
  • 48 (Notes 8)
  • 51 (Notes 8.5)

One significant change in the Record Relocation Vector (RRV) seems to be introduced in format revision 22.


The NSF basically is a collection of Notes. A Note in concept is similar to that of an object or item; mainly a container for data and metadata. Notes are used to store a vast variety of items, e.g. emails, documents, appointments, log-entries, data-views, forms, etc.


Notes can use various forms of encryption see: Notes from Support: Notes Encryption - Locks for a Digital World.

See also