Get macfor Pro

Pro plugin

Apple Notes

Collects Apple Notes.app forensic artifacts including note content, metadata, attachments, and collaboration data

notes.applePromacOS 10.15+v1.0.0userstoragemetadata

Run this plugin

Trigger collection for Apple Notes on its own with the --plugin flag, or include it in a wider sweep by category.

# Just this plugin
macfor-pro collect --plugin notes.apple --output ./evidence.zip

# Dry run — list what would be collected
macfor-pro collect --plugin notes.apple --dry-run

Compatibility

  • macOS 10.15+

Licensing: ships in the macfor-pro binary. See Community vs Pro.

Artifacts (14 collected)

Each row corresponds to an entry in the plugin's artifacts.yaml manifest. Optionalartifacts are often absent, and their absence isn't recorded as an error. Plannedartifacts are documented locations the plugin doesn't collect yet. Where a path shows a version range, macfor only tries it when the source's macOS or application version is in that range.

storage

ArtifactFormatPathNotes
NoteStore Database
notes_database
sqlite~/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite—
Notes Content
notes_contenthigh value
jsonl~/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite—
Notes Tables
notes_tableOptionalmedium value
jsonl~/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite—

metadata

ArtifactFormatPathNotes
Notes Metadata
notes_metadatahigh value
jsonl~/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite—
Notes Folders
notes_foldermedium value
jsonl~/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite—
Notes Accounts
notes_accountmedium value
jsonl~/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite—
Notes Participants
notes_participantOptionalmedium value
jsonl~/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite—
Notes Invitations
notes_invitationOptionalmedium value
jsonl~/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite—
Notes Changes
notes_changeOptionalhigh value
jsonl~/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite—
Notes Tags
notes_tagsOptionallow value
jsonl~/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite—
Legacy Database Detection
notes_legacy_detectedOptionalmedium value
jsonl~/Library/Containers/com.apple.Notes/Data/Library/Notes/NotesV7.storedata
+1 more
  • ~/Library/Containers/com.apple.Notes/Data/Library/Notes/NotesV6.storedata
Pre-Catalina legacy databases

media

ArtifactFormatPathNotes
Notes Attachments
notes_attachmentOptionalhigh value
jsonl~/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite—
Notes Media Base
notes_mediaOptionalhigh value
directory~/Library/Group Containers/group.com.apple.notes/Accounts—

config

ArtifactFormatPathNotes
Notes Preferences
notes_preferencesOptionallow value
binary_plist~/Library/Group Containers/group.com.apple.notes/Library/Preferences/group.com.apple.notes.plist—