Pro plugin

Evernote

Collects Evernote note content, notebooks, tags, attachments, and web clipper source URLs from both legacy .exb SQLite databases and the v10+ Electron conduit-storage format.

productivity.evernotePromacOS 10.15+v1.0.0userproductivitynotes

Run this plugin

Trigger collection for Evernote on its own with the --plugin flag, or include it in a wider sweep by category.

# Just this plugin
macfor-pro collect --plugin productivity.evernote --output ./evidence.zip

# Dry run — list what would be collected
macfor-pro collect --plugin productivity.evernote --dry-run

Compatibility

macOS 10.15+

Licensing: ships in the macfor-pro binary. See Community vs Pro.

Artifacts collected (5)

Each row corresponds to an entry in the plugin's artifacts.yaml manifest. Optional artifacts are skipped unless explicitly enabled.

metadata

Artifact	Format	Path	Notes
Evernote Notes evernote_notes	jsonl	`~/Library/Application Support/Evernote/accounts//conduit-storage` +1 more ~/Library/Application Support/Evernote/accounts//*.exb	Note metadata and stripped plain-text body. ENML bodies are tag-stripped; <en-crypt> blocks are flagged but not decoded.
Evernote Attachment Metadata evernote_attachments	jsonl	`~/Library/Application Support/Evernote/accounts//conduit-storage` +1 more ~/Library/Application Support/Evernote/accounts//*.exb	Attachment metadata only by default; raw attachment binaries are opt-in via include_attachment_blobs.

config

Artifact	Format	Path	Notes
Evernote Notebooks and Tags evernote_notebooks	jsonl	`~/Library/Application Support/Evernote/accounts//conduit-storage` +1 more ~/Library/Application Support/Evernote/accounts//*.exb	Notebook records (name, stack, shared status), tag records, and saved search definitions.

history

Artifact	Format	Path	Notes
Evernote Web Clipper Records evernote_web_clips	jsonl	`~/Library/Application Support/Evernote/accounts//conduit-storage` +1 more ~/Library/Application Support/Evernote/accounts//*.exb	Filtered subset of notes identified as Web Clipper captures via source application attribute.

storage

Artifact	Format	Path	Notes
Evernote Raw Databases evernote_raw	directory	`~/Library/Application Support/Evernote` +1 more ~/Library/Group Containers/*.com.evernote.Evernote	Opt-in via include_raw=true. Preserves databases with their WAL/SHM siblings for forensic reopen.