Evernote note storage

Author Name
Joseph W Shaw II


Artifact Name
Evernote note storage


Program Version
Evernote 4.3.1.4479


Description
Evernote is a tool used to capture, store, and share ideas and
information in the form of multimedia notes mixing text, images, pdfs,
and other document types into searchable “notes.” These notes are
stored in an SQLite database format. Records are appended to the end
of the database. As records are deleted, they are overwritten by new
records. However, data records can be retained inside of the database
when the SQLIite database is viewed in Text or Hex view.


File Locations
On Windows 7: C:\Users\\AppData\Local\Evernote\Evernote\Database\.exb


Forensic Programs of Use
SQLite Database Browser
EnCase 6.18.1.3 64bit


Old Record Search Hit

轉自 http://forensicartifacts.com/2011/06/evernote-note-storage/

0 意見: