Forensicswiki.org has moved to this site, forensicswiki.xyz. For information, please join the Google Group forensicswiki-reborn
Notes Storage Facility (NSF)
The NSF has the following file signature: hexadecimal: 1a 00 (which is often followed by: 00 04 00 00)
NSF defines an on-disk structure (ODS) version.
- 16 (Notes 1.x, 2x)
- 17 (Notes 3.x)
- 20 (Notes 4.x)
- 41 (Notes 5.x)
- 43 (Notes 6, 7 and 8)
- 48 (Notes 8)
- 51 (Notes 8.5)
One significant change in the Record Relocation Vector (RRV) seems to be introduced in format revision 22.
The NSF basically is a collection of Notes. A Note in concept is similar to that of an object or item; mainly a container for data and metadata. Notes are used to store a vast variety of items, e.g. emails, documents, appointments, log-entries, data-views, forms, etc.
Notes can use various forms of encryption see: Notes from Support: Notes Encryption - Locks for a Digital World.