Evernote Drag and Drop Files
Overview
Section titled “Overview”Evidence: Evernote Drag and Drop Files
Description: Collect Evernote Drag and Drop Files
Category: Applications
Platform: windows
Short Name: everdd
Is Parsed: No
Sent to Investigation Hub: No
Collect File(s): Yes
Background
Section titled “Background”Evernote temporarily stores files dragged and dropped into notes in the TEMP directory before processing. These files may remain cached after being added to notes.
Data Collected
Section titled “Data Collected”This collector gathers structured data about evernote drag and drop files.
Collection Method
Section titled “Collection Method”This collector gathers Evernote TEMP directories containing temporarily cached files from drag-and-drop operations.
Forensic Value
Section titled “Forensic Value”Evernote temp files can reveal recently added attachments, documents, images, or files that were incorporated into notes, providing additional evidence or context.