Blog >> Evernote

Investigating Evernote

22/11/2021 Monday

Evernote is one of the most popular note taking applications, it provides the users with a synchronized storage service using cloud servers, where they can save and organize their notes, ideas, photos, documents, and data from any device at any time they would need. It supports multiple operating systems, including Windows, macOS, Android, and iOS.

Digital Forensics Value of Evernote Artifacts

Evernote contains a valuable amount of information about user activities and interactions, as it is used in private environments, as well as in business environments, where critical data is processed and shared between different people. Various actions can be carried out using Evernote, such as creating a new note, a new notebook, or the deletion of it, and so much more. In addition, analyzing the log and database files provides a high forensic evidential value that could aid in investigations.

Location of Evernote Artifacts

Starting from version 10, Evernote artifacts are stored in the following location:


However, in prior versions, artifacts are stored in the following locations:


On the other hand, Evernote (Windows App) artifacts are retrieved from the following locations:

C:\Users\%User%\AppData\Local\Packages\Evernote.Evernote_q4d96b2w5wcc2\LocalCache\Roaming\Evernote\Local Storage\databases\<FileName>.db

Structure of Evernote Artifacts

Evernote stores its data in the database and logs folders. For the databases, it uses SQLite database format files with the extension .exb, which contain information such as the author, title, created and modified time, location, source, notebooks, and so much more is stored. Whereas the log file creates text files with the extension .txt, once a day when Evernote is launched, and it contains all user interactions such as authentication information, account ID, and the times when the application was started and ended.

Analyzing Evernote Artifacts with ArtiFast Windows

This section discusses how to use ArtiFast Windows to analyze Evernote artifacts from Windows machines and what kind of digital forensics insight we can gain from the artifacts.

After you have created your case and added evidence for the investigation, at the Artifacts Selection phase, you can select Evernote artifacts:

Once ArtiFast parser plugins complete processing artifacts for analysis, it can be reviewed via “Artifact View” or “Timeline View”, with indexing, filtering, and searching capabilities. Below is a detailed description of Evernote artifacts in ArtiFast Windows.

Evernote Notes Artifact

This artifact extracts Evernote notes data.

Evernote Logs Artifact

This artifact extracts Evernote log files.

Evernote (Win Apps) Notes Artifact

This artifact extracts the notes created by Evernote Windows application.

Evernote (Win Apps) Logs Artifact

This artifact extracts Evernote Windows application log files.

For more information or suggestions please contact: