added submission sheet for NSF file

[laissezfarrell]

Hello -

While looking at some NSF files in our collections, I noticed what looks to me consistent file signatures at offset 0x00 and 0x10. The pattern at 0x00 is also described in the NSF entry on Just Solve the File Format Problem and on the Forensics Wiki (links in the spreadsheet). I was unable to find corroborating documentation for the pattern at 0x10, but it was consistent across the files I looked at locally. I'm unable to share the files themselves, though I could share screencaps from a hex editor if that's helpful.

[laissezfarrell]

Also, this is my first contribution to this project, so any advice or correction for how I went about this would be greatly appreciated. Thanks for this resource!

[thorsted]

Nice. This format has come up a few times in the past. Had this conversation on Twitter with @anjackson. Apparently @neilsjefferies did some work on them years ago. It would be nice to get some clean identifications.

[neilsjefferies]

Every version of Notes changed the on-disk format so as well as a signature there is version info embedded. However, its ages since I messed with it in anger so I'll have to dig around. Since notes database content can be encrypted, you'll probably want to detect .id files that contain the keys. John the Ripper has some password cracking work going on to unlock .id files which might be useful.

[neilsjefferies]

This looks useful...https://github.com/libyal/libnsfdb/blob/main/documentation/Notes%20Storage%20Facility%20(NSF)%20database%20file%20format.asciidoc

[kmurmur]

Hi all - just FYI that we have an entry for NSF on the Sustainability of Digital Formats: https://www.loc.gov/preservation/digital/formats/fdd/fdd000433.shtml