±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 0 Overall: 36738
New Yesterday: 0 Visitors: 172

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

iCloud Notes stored on Mac

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts


iCloud Notes stored on Mac

Post Posted: Nov 14, 19 22:55

It’s my understanding that iCloud notes are usually GZip’d in notestore.sqlite databases on Mac and due to their compressible nature with proprietary algorithm by Apple.

Does Encase / Blackbag parse these files? Which files does Encase/Blacklight parse? I think there needs to be more transparency about it. There’s so many different file types stored on Mac just for notes which was divulged in the post here:


The Note content created on Mac usually resides on

Notestore.sqlite-wal (what’s different about this file)
Notestore.sqlite-shm (what’s different about this also?)

What I also want to know do these Forensic software allow keyword searching on these databases?  

Page 1 of 1