← All artifacts

Apple Notes

Apple Notes database containing note content, folders, attachments, embedded tables, collaboration data, and change history.

Status
available
CLI plugin
notes.apple
Categories
productivity, user

Overview

Apple Notes stores all content in a Core Data SQLite database. Note bodies are gzip-compressed protobuf blobs that the collector decodes to extract plain text. The collector also captures folders, accounts, attachments with geolocation metadata, embedded tables (stored as mergeable data), collaboration participants, and change history.

Analysis Tips

  • Entity resolution: Always read Z_PRIMARYKEY to resolve entity type IDs — never hardcode Z_ENT values
  • Encrypted notes: If ZICNOTEDATA.ZDATA lacks the gzip magic bytes (0x1f 0x8b), the note is encrypted
  • Embedded tables: Tables are stored in ZMERGEABLEDATA1 on attachment rows with UTI com.apple.notes.table
  • Geolocation: ZICLOCATION contains GPS coordinates for photo and map attachments
  • Collaboration: ZICNOTEPARTICIPANT and ZICINVITATION reveal sharing activity
  • Legacy detection: NotesV6.storedata and NotesV7.storedata indicate older database versions

Related Artifacts

References

Data sources

NoteStore.sqliteSQLite (Core Data)

~/Library/Group Containers/group.com.apple.notes/

All notes, folders, accounts, attachments, and collaboration data, plus tags on macOS 14+

group.com.apple.notes.plistBinary Plist

~/Library/Group Containers/group.com.apple.notes/Library/Preferences/

Notes preferences and account configuration (opt-in)

Attachment mediaVarious (JPEG, PNG, PDF)

~/Library/Group Containers/group.com.apple.notes/Accounts/{UUID}/Media/

Note attachment files (opt-in collection)