Type Apple Note Database

<< Details >>

Defined Constant	Type_Apple_Note_Database
File Type Value	539
Parent Type	SQLite
Carve	Yes
Format Details	Yes
MIME Type	application/vnd.sqlite3
Filename Extension	sqlite

Apple Notes

Description

Apple Notes Database

Truxton Exploiters

This file type is handled by the following ETLs:

• Expand

Items Produced

Truxton will extract the following from this file type:

• EVENT_TYPE_APPLE_NOTE
• Type_Apple_Note_Text
• Type_File_Details
• Type_SQLite_Sample

Filenames Seen

• NoteStore.sqlite
• notes.sqlite
• 4f98687d8ab0d6d1a371110e6b7300f6e465bef2
• ca3bc056d4da0bbf88b5fb3be254f3b7147e639c

Details

• Apple Notes
• iOS 9 Changes