iCloud Notes stored...
 
Notifications
Clear all

iCloud Notes stored on Mac

1 Posts
1 Users
0 Likes
808 Views
(@samsacksons)
Posts: 8
Active Member
Topic starter
 

It’s my understanding that iCloud notes are usually GZip’d in notestore.sqlite databases on Mac and due to their compressible nature with proprietary algorithm by Apple.

Does Encase / Blackbag parse these files? Which files does Encase/Blacklight parse? I think there needs to be more transparency about it. There’s so many different file types stored on Mac just for notes which was divulged in the post here

https://www.swiftforensics.com/2018/02/reading-notes-database-on-macos.html?m=1

The Note content created on Mac usually resides on

NotesVX.storedata
Notestore.sqlite-wal (what’s different about this file)
Notestore.sqlite-shm (what’s different about this also?)

What I also want to know do these Forensic software allow keyword searching on these databases?

 
Posted : 14/11/2019 10:55 pm
Share: