Nickfile
From Just Solve the File Format Problem
(Difference between revisions)
m |
(→Links: Updating Forensics Wiki links) |
||
| (One intermediate revision by one user not shown) | |||
| Line 8: | Line 8: | ||
Files begin with hex bytes <code>0D F0 AD BA</code>. | Files begin with hex bytes <code>0D F0 AD BA</code>. | ||
| + | |||
| + | == Software == | ||
| + | * [https://github.com/libyal/libnk2/ libnk2] - library to access the Microsoft Outlook Nickfile (NK2) format. | ||
| + | * [https://www.nirsoft.net/utils/outlook_nk2_edit.html NK2Edit] - Window tool to edit AutoComplete files of Microsoft Outlook. | ||
| + | * [https://www.cgsecurity.org/wiki/File_Formats_Recovered_By_PhotoRec TestDisk] tool to recover/undelete Outlook files. | ||
== Links == | == Links == | ||
| − | * [https:// | + | * [https://github.com/libyal/libnk2/blob/main/documentation/Nickfile%20(NK2)%20format.asciidoc Format specification (libnk2 project)] |
| − | * [https:// | + | * [https://fossies.org/linux/libpst/xml/MAPI_definitions.pdf MAPI definitions (libpst project)] |
| − | * [ | + | * [{{ForensicsWikiURL|nickfile_%28nk2%29}} Forensic Wiki page] |
[[Category:Microsoft]] | [[Category:Microsoft]] | ||
Latest revision as of 14:43, 3 September 2023
A Nickfile (NK2) is used by Microsoft Outlook to store e-mail aliases.
[edit] File identification
Files begin with hex bytes 0D F0 AD BA.
[edit] Software
- libnk2 - library to access the Microsoft Outlook Nickfile (NK2) format.
- NK2Edit - Window tool to edit AutoComplete files of Microsoft Outlook.
- TestDisk tool to recover/undelete Outlook files.
