Evidence: Evernote Drag and Drop Files
Description: Collect Evernote Drag and Drop Files
Category: Applications
Platform: windows
Short Name: everdd
Is Parsed: No
Sent to Investigation Hub: No
Collect File(s): Yes
Background
Evernote temporarily stores files dragged and dropped into notes in the TEMP directory before processing. These files may remain cached after being added to notes.
Data Collected
This collector gathers structured data about evernote drag and drop files.
Collection Method
This collector gathers Evernote TEMP directories containing temporarily cached files from drag-and-drop operations.
Forensic Value
Evernote temp files can reveal recently added attachments, documents, images, or files that were incorporated into notes, providing additional evidence or context.
