Digital Forensics, Investigation, and Response Practice Test

Lotus Notes databases are stored in files with the .nsf extension. NSF stands for Notes Storage Facility, the native database format used by Lotus Notes and the Domino server to hold documents, mail, calendars, and design elements. When you see a file with .nsf on a system, it strongly indicates Lotus Notes activity and provides a clear lead for further artifact analysis. The other extensions come from different email ecosystems: PST and OST are associated with Microsoft Outlook/Exchange, and MBOX is used by various mail clients. So recognizing .nsf helps identify Lotus Notes data and guides how to search for relevant artifacts like emails, contacts, and calendar entries within those databases.