closes #547: signature and classification for Lotus Notes NSF files

sepinf-inc · Jun 28, 2021 · bf89131 · bf89131
1 parent af7c655
commit bf89131
Show file tree

Hide file tree

Showing 7 changed files with 21 additions and 6 deletions.
diff --git a/iped-app/resources/config/conf/CustomSignatures.xml b/iped-app/resources/config/conf/CustomSignatures.xml
@@ -435,6 +435,21 @@
         <sub-class-of type="text/plain"/>
         <glob pattern="*.mbox"/>
     </mime-type>
+
+    <mime-type type="application/vnd.lotus-notes">
+        <magic priority="60">
+            <match value="0x1A00" type="string" offset="0">
+                <match value="0x10000000" type="string" offset="6"/>
+                <match value="0x11000000" type="string" offset="6"/>
+                <match value="0x14000000" type="string" offset="6"/>
+                <match value="0x29000000" type="string" offset="6"/>
+                <match value="0x2B000000" type="string" offset="6"/>
+                <match value="0x30000000" type="string" offset="6"/>
+                <match value="0x33000000" type="string" offset="6"/>
+            </match>    
+        </magic>  
+        <glob pattern="*.nsf"/>      	
+    </mime-type>
 
 	<mime-type type="application/x-mssql">
         <magic priority="50">

diff --git a/iped-app/resources/config/profiles/blind/conf/CategoriesByTypeConfig.txt b/iped-app/resources/config/profiles/blind/conf/CategoriesByTypeConfig.txt
@@ -29,7 +29,7 @@ Other Documents = application/vnd.ms-xpsdocument; application/vnd.visio; applica
 
 Emails = message/rfc822; message/x-emlx; application/vnd.ms-outlook; message/outlook-pst; application/x-ufed-html-mails; message/x-ufed-email
 
-Mailboxes = application/vnd.ms-outlook-pst; application/outlook-dbx; application/mbox; application/x-incredimail
+Mailboxes = application/vnd.ms-outlook-pst; application/outlook-dbx; application/mbox; application/x-incredimail; application/vnd.lotus-notes
 
 User Activities = application/x-win10-timeline;
 

diff --git a/iped-app/resources/config/profiles/default/conf/CategoriesByTypeConfig.txt b/iped-app/resources/config/profiles/default/conf/CategoriesByTypeConfig.txt
@@ -29,7 +29,7 @@ Other Documents = application/vnd.ms-xpsdocument; application/vnd.visio; applica
 
 Emails = message/rfc822; message/x-emlx; application/vnd.ms-outlook; message/outlook-pst; application/x-ufed-html-mails; message/x-ufed-email
 
-Mailboxes = application/vnd.ms-outlook-pst; application/outlook-dbx; application/mbox; application/x-incredimail
+Mailboxes = application/vnd.ms-outlook-pst; application/outlook-dbx; application/mbox; application/x-incredimail; application/vnd.lotus-notes
 
 User Activities = application/x-win10-timeline;
 

diff --git a/iped-app/resources/config/profiles/fastmode/conf/CategoriesByTypeConfig.txt b/iped-app/resources/config/profiles/fastmode/conf/CategoriesByTypeConfig.txt
@@ -29,7 +29,7 @@ Other Documents = application/vnd.ms-xpsdocument; application/vnd.visio; applica
 
 Emails = message/rfc822; message/x-emlx; application/vnd.ms-outlook; message/outlook-pst; application/x-ufed-html-mails; message/x-ufed-email
 
-Mailboxes = application/vnd.ms-outlook-pst; application/outlook-dbx; application/mbox; application/x-incredimail
+Mailboxes = application/vnd.ms-outlook-pst; application/outlook-dbx; application/mbox; application/x-incredimail; application/vnd.lotus-notes
 
 User Activities = application/x-win10-timeline;
 

diff --git a/iped-app/resources/config/profiles/forensic/conf/CategoriesByTypeConfig.txt b/iped-app/resources/config/profiles/forensic/conf/CategoriesByTypeConfig.txt
@@ -29,7 +29,7 @@ Other Documents = application/vnd.ms-xpsdocument; application/vnd.visio; applica
 
 Emails = message/rfc822; message/x-emlx; application/vnd.ms-outlook; message/outlook-pst; application/x-ufed-html-mails; message/x-ufed-email
 
-Mailboxes = application/vnd.ms-outlook-pst; application/outlook-dbx; application/mbox; application/x-incredimail
+Mailboxes = application/vnd.ms-outlook-pst; application/outlook-dbx; application/mbox; application/x-incredimail; application/vnd.lotus-notes
 
 User Activities = application/x-win10-timeline;
 

diff --git a/iped-app/resources/config/profiles/pedo/conf/CategoriesByTypeConfig.txt b/iped-app/resources/config/profiles/pedo/conf/CategoriesByTypeConfig.txt
@@ -29,7 +29,7 @@ Other Documents = application/vnd.ms-xpsdocument; application/vnd.visio; applica
 
 Emails = message/rfc822; message/x-emlx; application/vnd.ms-outlook; message/outlook-pst; application/x-ufed-html-mails; message/x-ufed-email
 
-Mailboxes = application/vnd.ms-outlook-pst; application/outlook-dbx; application/mbox; application/x-incredimail
+Mailboxes = application/vnd.ms-outlook-pst; application/outlook-dbx; application/mbox; application/x-incredimail; application/vnd.lotus-notes
 
 User Activities = application/x-win10-timeline;
 

diff --git a/iped-app/resources/config/profiles/triage/conf/CategoriesByTypeConfig.txt b/iped-app/resources/config/profiles/triage/conf/CategoriesByTypeConfig.txt
@@ -29,7 +29,7 @@ Other Documents = application/vnd.ms-xpsdocument; application/vnd.visio; applica
 
 Emails = message/rfc822; message/x-emlx; application/vnd.ms-outlook; message/outlook-pst; application/x-ufed-html-mails; message/x-ufed-email
 
-Mailboxes = application/vnd.ms-outlook-pst; application/outlook-dbx; application/mbox; application/x-incredimail
+Mailboxes = application/vnd.ms-outlook-pst; application/outlook-dbx; application/mbox; application/x-incredimail; application/vnd.lotus-notes
 
 User Activities = application/x-win10-timeline;