Pro plugin

Apple Notes

Collects Apple Notes.app forensic artifacts including note content, metadata, attachments, and collaboration data

notes.applePromacOS 10.15+v1.0.0userstoragemetadata

Run this plugin

Trigger collection for Apple Notes on its own with the --plugin flag, or include it in a wider sweep by category.

# Just this plugin
macfor-pro collect --plugin notes.apple --output ./evidence.zip

# Dry run — list what would be collected
macfor-pro collect --plugin notes.apple --dry-run

Compatibility

macOS 10.15+

Licensing: ships in the macfor-pro binary. See Community vs Pro.

Artifacts collected (12)

Each row corresponds to an entry in the plugin's artifacts.yaml manifest. Optional artifacts are skipped unless explicitly enabled.

storage

Artifact	Format	Path	Notes
NoteStore Database notes_database	sqlite	`~/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite`	—
Notes Content notes_contenthigh value	jsonl	`~/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite`	—
Notes Tables notes_tableOptionalmedium value	jsonl	`~/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite`	—

metadata

Artifact	Format	Path	Notes
Notes Metadata notes_metadatahigh value	jsonl	`~/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite`	—
Notes Folders notes_foldermedium value	jsonl	`~/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite`	—
Notes Accounts notes_accountmedium value	jsonl	`~/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite`	—
Notes Participants notes_participantOptionalmedium value	jsonl	`~/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite`	—
Notes Invitations notes_invitationOptionalmedium value	jsonl	`~/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite`	—
Notes Changes notes_changeOptionalhigh value	jsonl	`~/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite`	—
Notes Tags notes_tagsOptionallow value	jsonl	`~/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite`	—
Legacy Database Detection notes_legacy_detectedOptionalmedium value	jsonl	`~/Library/Containers/com.apple.Notes/Data/Library/Notes/NotesV7.storedata` +1 more ~/Library/Containers/com.apple.Notes/Data/Library/Notes/NotesV6.storedata	Pre-Catalina legacy databases

media

Artifact	Format	Path	Notes
Notes Attachments notes_attachmentOptionalhigh value	jsonl	`~/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite`	—