Evernote note storage

Author Name
Joseph W Shaw II

Artifact Name
Evernote note storage

Program Version
Evernote 4.3.1.4479

Description
Evernote is a tool used to capture, store, and share ideas and
information in the form of multimedia notes mixing text, images, pdfs,
and other document types into searchable “notes.” These notes are
stored in an SQLite database format. Records are appended to the end
of the database. As records are deleted, they are overwritten by new
records. However, data records can be retained inside of the database
when the SQLIite database is viewed in Text or Hex view.

File Locations
On Windows 7: C:\Users\\AppData\Local\Evernote\Evernote\Database\.exb

Forensic Programs of Use
SQLite Database Browser
EnCase 6.18.1.3 64bit

Old Record Search Hit

轉自 http://forensicartifacts.com/2011/06/evernote-note-storage/