Microsoft Sticky Notes
Overview
Section titled “Overview”Evidence: Microsoft Sticky Notes
Description: Collect Microsoft Sticky Notes
Category: Applications
Platform: windows
Short Name: stckyn
Is Parsed: No
Sent to Investigation Hub: No
Collect File(s): Yes
Background
Section titled “Background”Microsoft Sticky Notes stores user-created notes in SQLite databases (modern version) or SNT files (legacy version). These notes can contain passwords, reminders, sensitive information, and personal or work-related content.
Data Collected
Section titled “Data Collected”This collector gathers structured data about microsoft sticky notes.
Collection Method
Section titled “Collection Method”This collector gathers plum.sqlite database files from the modern Sticky Notes app and legacy .snt files from the Roaming profile directory.
Forensic Value
Section titled “Forensic Value”Sticky Notes often contain valuable information including passwords, account details, IP addresses, system information, and notes related to investigations. They can reveal user intentions, planned activities, and sensitive data exposure.