Investigating Lotus Notes Mailstorage
Posted by Jack H. Ward, Last modified by Jack H. Ward on 05 February 2018 10:05 AM

To investigate a Lotus Notes mailstorage, do the following:

1.  Have the Add New Evidence window open.

2. In the Category list, select E-mail Database. In the Source Type list, select NSF database. Click OK.

3. In the standard Open window, navigate to the desired *.nsf file. Click OK.
4. Enter the Evidence name (by default, the name of the file to be added) and click OK.
5. Define the NSF Database Settings and click OK.

6. The Lotus Notes mailstorage is added to the case.
7. The mailstorage structure is displayed in the Case Content pane, messages stored in the mailbox are displayed in the Data View pane. 

8. The deleted messages are marked as service files and their content cannot be viewed.

9. Select the message in the Data View pane. Its contents are displayed in the E-mail Data pane (at the bottom).

10. You can view the message contents in different formats and/or view the attachments.

 NSF database.png (43.88 KB)
 NSF database step 2.png (12.28 KB)
 NSF database step 3.png (71.33 KB)
 NSF database step 4.png (19.58 KB)
(0 vote(s))
Not helpful

Comments (0)