Evernote Drag and Drop Files

Overview

Evidence: Evernote Drag and Drop Files Description: Collect Evernote Drag and Drop Files Category: Applications Platform: windows Short Name: everdd Is Parsed: No Sent to Investigation Hub: No Collect File(s): Yes

Background

Evernote temporarily stores files dragged and dropped into notes in the TEMP directory before processing. These files may remain cached after being added to notes.

Data Collected

This collector gathers structured data about evernote drag and drop files.

Collection Method

This collector gathers Evernote TEMP directories containing temporarily cached files from drag-and-drop operations.

Forensic Value

Evernote temp files can reveal recently added attachments, documents, images, or files that were incorporated into notes, providing additional evidence or context.