Apple Notes Forensics: The Quiet Evidence Locker

Apple Notes is one of the most underestimated artifacts on an iPhone. Because it is the app of least resistance, people put things there they would never put in a document: passwords and account numbers, drafts of messages they thought better of sending, lists, plans, scanned paperwork and photographs of things that mattered enough to keep. In an investigation that mix is often more revealing than the polished communication elsewhere on the device.

Sherlock Forensics iPhone Analyzer reconstructs the full Notes surface into a searchable view: note text with created and modified times, the folder structure, checklists, pinned notes and the attachments a note carries, including images, scanned documents, sketches and tables. Each note is searchable on its own and every note feeds the merged Activity Timeline and global search, so a note written at a particular moment reads in sequence with the messages, locations and app activity around it. A name or a number typed into a private note surfaces next to everywhere else it appears on the device.

A credible Notes analysis has to be straight about locked notes. When a user locks a note, its body is encrypted with a password only they set. That encryption is real. Sherlock surfaces that a locked note exists, with its metadata such as title, folder and timestamps, so an examiner can see and document that a protected note is present. It does not show the protected content without the note password. It does not pretend to. A tool that claimed to read a locked note without the password would be overstating what the encryption allows.

That honesty is itself useful. The presence of a locked note, together with when it was created or last changed, is a documented fact an examiner can act on: it can support a request for the password through proper channels or simply establish that protected material existed at a given time. The discipline is the same one Sherlock applies everywhere. Report exactly what the evidence yields, mark what stays sealed and never blur the line between what was read and what was locked.

Apple Notes is carried inside an encrypted iPhone backup, so the Notes record does not require a full-filesystem extraction to reach. Sherlock reconstructs the Notes views from a backup you make over USB from a device you can unlock and Trust, from an existing iTunes or Finder backup or from a Cellebrite UFED or VeraKey full-filesystem extraction. Whichever way the evidence arrived, the notes, the folders and the attachments are available, which makes Notes one of the more accessible high-value artifacts in an iPhone case.

A full-filesystem extraction adds surrounding depth that a logical backup does not carry, but the Notes record itself comes through a backup in full, locked notes included as locked. An examiner does not need enterprise acquisition tooling to work the Notes evidence, which is often exactly where an overlooked detail turns up.

A deleted note does not vanish at once. It first moves to the Recently Deleted folder, where it stays for about 30 days and is fully readable the whole time, a window that closes quietly if nobody looks. After that the note's database record is not wiped on the spot; iOS marks its SQLite page free, so Sherlock carves the record back out through standard freed-page carving until new data overwrites it.

What survives therefore depends on time and device use after the deletion. A note cleared shortly before acquisition on a lightly used phone is often recoverable; a note cleared weeks ago on a heavily used device has usually been overwritten and no tool brings it back. Sherlock flags every carved note as recovered in the interface and the report, so an examiner can state on the record which notes were live and which were carved and can explain the survival logic without overclaiming. This is the same freed-page methodology every credible tool works under; the value is honest labeling, not a promised recovery number.

Notes can carry the most sensitive material on a device, so the documentation is built to keep it precise: the court-ready HTML report carries case and evidence numbers, examiner identification, disclosed methodology, per-artifact SHA-256 hashing and an optional evidence-integrity manifest, with recovered notes flagged and locked notes marked as locked throughout, the documentation practice set out in NIST Special Publication 800-101 Revision 1, Guidelines on Mobile Device Forensics. Analysis is 100 percent read-only; the evidence is never modified.

Built by CISSP, ISSAP and ISSMP certified examiners with 20 years of court-defensible practice. Admissibility depends on jurisdiction, authority and evidence handling; the report documents the record so testimony rests on it rather than on recollection.

Sherlock reads Apple Notes from evidence you can lawfully acquire: a device you can unlock, an existing backup or a full-filesystem extraction produced by acquisition tooling. It does not unlock a locked device, does not bypass a passcode and does not decrypt a password-locked note without its password. Notes deleted long enough ago to be overwritten are gone. Notes still in Recently Deleted are read as the live records they still are. Sherlock reports what the acquired evidence carries, flags what it recovered and marks what stays locked, which is what an examiner can defend on the stand.

Download the free edition, open a backup or extraction and read the Notes record yourself. Unlock the full analysis and carved notes when the case calls for it: $599 one-time, no subscription.

Get Sherlock Forensics iPhone Analyzer

Related: iMessage forensics · iPhone full-filesystem analysis · The full parser list · Product page