Evernote
Evernote desktop artifacts — notes, notebooks, attachment metadata and web clips from v10+ and legacy SQLite databases.
- Status
- available
- CLI plugin
- productivity.evernote
- Categories
- productivity, user
Overview
Evernote v10+ stores its data in conduit-storage SQLite databases. The legacy client uses .exb SQLite databases. macfor reads both and produces records for notes, notebooks, attachment metadata and web clips. Note bodies are ENML; macfor strips the markup to plain text. Forensic value is medium — notes are a common place for users to paste credentials, addresses, and one-off snippets.
Analysis Tips
- v10+ vs legacy:
conduit-storagemeans v10+,.exbfiles mean the legacy client. Both can exist if the user has migrated - Web clipper sources: Notes made with the Evernote Web Clipper carry a source URL — direct evidence of web pages saved
- Encrypted sections: Notes with
<en-crypt>blocks are flagged, but the encrypted content is not decoded - Attachments: macfor records attachment metadata (filename, MIME type, size, timestamps, MD5 hash, parent note). It does not copy the attachment files themselves by default
- Raw copies: An opt-in raw mode copies the Evernote databases (with WAL/SHM files) and the preferences plist for independent analysis
Related Artifacts
- Apple Notes - Compare against the system notes artifact
- Quarantine Events - Files attached via web clipper may be quarantined
- Pattern of Life - Confirms Evernote was actively used in a given period
References
Data sources
~/Library/Application Support/Evernote/accounts/*/
Evernote v10+ notes (with ENML bodies), notebooks, tags, saved searches, attachment metadata and web clips
~/Library/Application Support/Evernote/accounts/*/
Legacy (pre-v10) Evernote notes, notebooks, tags, attachment metadata and web clips
~/Library/Application Support/Evernote/ or ~/Library/Application Support/com.evernote.WebClipper/
Evernote Web Clipper extension configuration