Practical Mobile Forensics - Fourth Edition

Notes

The Notes database contains the notes that are created by the user using the device's built-in Notes application. Notes is the simplest application, often containing the most sensitive and confidential information. The Notes database can be found at /HomeDomain/Library/Notes/notes.sqlite.

The ZNOTE and ZNOTEBODY tables in the notes.sqlite file contain each note's title, content, creation date, modification date, and more. You can run the following queries to parse the Notes database:

Examining notes in DB4S

This query merges data from two tables, so we use ZOWNER from ZNOTEBODY, Z_PK from ZNOTE, and a WHERE clause to do it.