• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 6256
  • Last Modified:

How can we access an encrypted NSF file without the ID file

The legal department of our company has asked us to restore a particular users email from backup from 2 years ago.  We were able to find a couple of encrypted NSF files from the requested time period, but no ID files and we have since migrated from Notes to Exchange.  So is there a way to recover the email from an encrypted NSF file without the ID file and without the Domino server?  We think the files were generated with Lotus Notes version 7.
0
GuruGary
Asked:
GuruGary
4 Solutions
 
mekhet30Commented:
Without the ID there is no way that you are going to decrypt the information.

The keys that are used to encrypt the data is stored in the ID file and there is no way to re-create the exact key.  

Sorry - I know this is not what you want to hear.
0
 
Sjef BosmanGroupware ConsultantCommented:
So you didn't back up the ID-file of every user or the server?? Oh dear me...

By the way, how do you know the files are encrypted? NSF databases are in a special format, and the easiest way to read them is with Lotus Notes, so you won't see anything readable when you try with Notepad or so. If the database is not encrypted, you might be able to read it with Notes client, provided that the user left the door open (the ACL in this case).

By the way, was the migration successful, and did it save you money (talking TCO)? No need to answer that...
0
 
fgrushevskyCommented:
There might be some companies who might be able to help.
I was in similar situation several years ago (legal discovery, encrypted emails within NSF, although no encrypted NSFs).  a law firm that was working for our organization hired a company to do the digging. They asked for whatever IDs we still had, nsf files, copy of the restored address book etc. The files were generated with Lotus Notes 4 and the encryption keys were international - meaning smaller/shorter (). I was told that this company managed to recover required emails.
I can't recall company name, I suggest  you search for companies who are specialized in email forensic analysis


0
 
SysExpertCommented:
R4 and R5 were hackable from the IS point of view, but R6 and above not really.

There are some cracking - brute force ID crackers around, but it depends on the PW, how successful they are going to be.

If these are from the server, they are normally NOT encrypted. If  a local replica then it may be encrypted.

DO you have an ID like an admin ID that had access to all mail ?

If you rebuild a Notes server, there is a chance to recover if your backups are server based, and you have admin and server IDs


I hope this helps !
0
 
GuruGaryAuthor Commented:
All of your comments are helpful.  I will probably leave this open for a few more days just in case somebody else has something to add.
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now