An artifact analysis for Evernote Touch App. for forensics investigations

1. Evernote Touch Artifact Report
By
AZIZ SASMAZ

2. Introduction
Evernote Touch can be downloaded from Windows store. It uses sqlite database to store
information. It also uses a log file to store important events such as when the notes
created, which attachments were saved and where they were saved, and many other
evernote system logs.
Artifact Structure
Evernote touch app uses an sqlite database named Evernote.db
A logfile is created as YYMMDD.log
Evernote.db consists of the below tables;
LinkedNotebook, Note, NoteTag, Notebook, Preferences, PreferencesValue, RecentSearch,
RecentSearchToNote, ReplaceGuids, Resource, SavedSearch, SavedSearchToNote, SyncFail,
SyncStatus,Tag
Example:
Example Note table:
Guid 5217047a-6bd3-44c7-ba0e-47e2cdd19a9e
Title Secret certificates
ContentHash binary
ContentLength 676
Created 1463946090000
Updated 1463946140000
Deleted 1462971847000
Expunged 0
UpdateSequenceNumber 16
Notebookguid 137225e6-8446-40d0-9199-6f58174218dc
subjectDate 0
Latitude 0.0
Longtitude 0.0
Altitude 0.0
Author
Source
SourceApplication
Dirty 0
City
Country

3. ContentDownload 1
ThumbnailDownloaded
Snippet About the stolen certificates. This is not good.
SourceURL
TaskDate
TaskCompleteDate
TaskDueDate
PlaceName
ContentClass
LinkedNotebookGuid
PinProminence
ReminderDoneTime 0
ReminderOrder 0
NoteTitleQuality 0
An example Log file 2016.05.23.txt
5/23/2016 11:21:35 AM: Main(8) Error Evernote.Services.AppCustom.LoadcustomData
C:Program FilesWindowsAppsEvernote.Evernote_3.3.0.102_x86__q4d96b2w5wcc2
5/23/2016 11:21:35 AM: Main(7) FunctionInfo EvernoteShared.Engine.Synchronizer.RequestSynchronize
Requested
5/23/2016 11:21:35 AM: Main(7) MethodCall EvernoteShared.Engine.Synchronizer.Synchronize Start
5/23/2016 11:21:35 AM: Main(5) FunctionInfo EvernoteShared.Store.NotebookAndStackList.LoadNotebooks
5/23/2016 11:21:35 AM: Main(5) FunctionInfo EvernoteShared.Store.NotebookAndStackList.RebuildItemsList
5/23/2016 11:21:35 AM: Main(e) FunctionInfo EvernoteShared.Store.NotebookAndStackList.BuildNotebooks
5/23/2016 11:21:36 AM: Main(5) FunctionInfo EvernoteShared.Engine.Synchronizer.ShouldSkipChunks Should
skip
5/23/2016 11:21:36 AM: Main(e) FunctionInfo EvernoteShared.Engine.Synchronizer.SendChanges Sync
sending changes ...
5/23/2016 11:21:36 AM: Main(e) FunctionInfo EvernoteShared.Engine.Synchronizer.SendChanges Sync
finished sending changes ...
5/23/2016 11:21:41 AM: Main(5) MethodCall Evernote.Views.NoteView.SetBrowserSource Invoked
5/23/2016 11:21:41 AM: Main(5) FunctionInfo
Evernote.Views.NoteView.SetBrowserSource HtmlPath is
Evernote_0.001_142137710Note11c4f8b402-5e3b-44cd-8a55-27004902c87f.html
5/23/2016 11:21:41 AM: Main(5) FunctionInfo
Evernote.Views.NoteView.WebBrowserNavigating NoteView setting browser source to
/local/Evernote_0.001_142137710/Note/11/c4f8b402-5e3b-44cd-8a55-27004902c87f.html
5/23/2016 11:21:41 AM: Main(7) MethodCall Evernote.Views.NoteView.SaveNoteChanges
Note Title: Evernote notlari Note Guid: c4f8b402-5e3b-44cd-8a55-27004902c87f
5/23/2016 11:21:41 AM: Main(e) FunctionInfo Evernote.Views.NoteView.SetBrowserSource
fileContentHash: 40d368a558ca6737e3801206134c3a8c
_fileContentHash: isNeedRefreshHtml: False
5/23/2016 11:21:41 AM: Main(e) MethodCall
EvernoteShared.ViewModels.EditNoteViewModel.TransformToHtml Content size is 676
5/23/2016 11:21:41 AM: Main(7) MethodCall Evernote.Views.NoteView.GetHtmlContent
GetHtmlContent ...

4. 5/23/2016 11:21:41 AM: Main(e) MethodCall
EvernoteShared.ViewModels.EditNoteViewModel.GetInputText GetInputText ...
5/23/2016 11:21:41 AM: Main(7) FunctionInfo
EvernoteShared.ViewModels.EditNoteViewModel.GetInputText text:
<div><br></div><div>Onemli dosyalar</div><div>always goes to the same
place</div><div><br></div><div>Put all your belongins to the
desk</div><div>C:Usersasamazsecret</div><div><br></div><div>military
files</div><div>C:UsersasasmazAppDataLocalPackagesEvernote.Evernote_q4d96b2
w5wcc2LocalStateEvernote_0.001_142137710Index</div><div><br></div><div><br></
div><div><br></div>
5/23/2016 11:21:42 AM: Main(5) FunctionInfo
EvernoteShared.ViewModels.EditNoteViewModel.TransformToHtml
EditableResources.Count: 0
Software Version:
Windows 10 Home, Version 1511, OS build 10586.104, Evernote Touch 3.3.0.2 for windows
store
Artifact location:
SQLite:
C:UsersasasmazAppDataLocalPackagesEvernote.Evernote_q4d96b2w5wcc2LocalStat
eEvernote_0.001_142137710Index
Log Files:
C:UsersasasmazAppDataLocalPackagesEvernote.Evernote_q4d96b2w5wcc2LocalStat
eLogs
HTML Files:
C:UsersasasmazAppDataLocalPackagesEvernote.Evernote_q4d96b2w5wcc2LocalStat
eEvernote_0.001_142137710Note
Attachments in the Notes:
C:UsersasamazAppDataLocalPackagesEvernote.Evernote_q4d96b2w5wcc2LocalState
Evernote_0.001_142137710Resource
Tools used in Analysis:
Text Editor: NotePad or TextPad
SQLite Browser: SqLite Database Browser Portable
Important Attributes:
We will discuss the most important tables here such as Note, Resource, SyncStatus, Tag.
The main table for the notes are Note.

5. Table Note:
Name Description Type
Guid This is a unique identifier uniqueidentifier
Title Title of the Note nvarchar
ContentHash Hash of the note binary
ContentLength Length of the note int
Created when the note created bigint
Updated Last updated time of the note bigint
Deleted when the note deleted bigint
Expunged when the note permanantly removed? bigint
Active Is the note active or deleted? bit
UpdateSequenceNumber int
Notebookguid uniqueidentifier
subjectDate bigint
Latitude Latitude where the user created the note float
Longtitude Longtitude where the user created the note float
Altitude Altitude where the user created the note float
Author nvarchar
Source nvarchar
SourceApplication nvarchar
Dirty bit
City nvarchar
Country nvarchar
ContentDownload bit
ThumbnailDownloaded bit
Snippet nvarchar
SourceURL nvarchar
TaskDate bigint
TaskCompleteDate bigint
TaskDueDate bigint
PlaceName nvarchar
ContentClass nvarchar
LinkedNotebookGuid uniqueidentifier
PinProminence bigint
ReminderTime Reminder time if the note is a reminder bigint
ReminderDoneTime bigint
ReminderOrder bigint
NoteTitleQuality int
Table Resource:
Name Description Type

6. Guid unique identifier uniqueidentifier
NoteGuid uniqueidentifier
Mime Mime type of attached file nvarchar
Width width of the file if image smallint
Height height of the file if image smallint
UpdateSequenceNum int
Timestamp timestamp of the attachment bigint
Latitude float
Longitude float
Altitude float
CameraMake
Camera model of the attached
image
nvarchar
CameraModel nvarchar
ClientWillIndex bit
FileName Filename of the attached file nvarchar
Attachment If it's attachment bit
RecognitionBodyHash binary
DataBodyHash binary
DataSize int
SourceUrl nvarchar
PostItColor nvarchar
HandwritingVersion int
Table Sync Status:
LastUpdateCount int
InitialSyncInProgress bit
LastSyncTime bigint
Table Tag:
Guid uniqueidentifier
Name nvarchar
ParentGuid uniqueidentifier
UpdateSequenceNumint
Dirty bit
Depth int
OrderInHierarchy int
LinkedNotebookGuid uniqueidentifier
Deleted bigint
Date Attributes
In SQLite database, we can find created, updated, deleted, expunged times of the notes in
the Note table as epoch time format.
In the Resource table we can find the attached time of the file in epoch time format either.

7. The date attributes can be found in the log files located
under C:UsersasasmazAppDataLocalPackagesEvernote.Evernote_q4d96b2w5wcc2Loc
alStateLogs directory as localtime.
Investigation Scenario:
Alice has accused of killing a man with a poison. The court has not so many evidence
supporting the case. But the judge thinks it could be a very well planned crime and thinks
maybe some kind of notes are taken. You are a computer forensics investigator and have
been asked the following to support the case:
 Are there any notes related to poisons and how to make one?
 Are there any notes related to the man?
 When the notes were created?