Microsoft Sticky Notes

Overview

Evidence: Microsoft Sticky Notes Description: Collect Microsoft Sticky Notes Category: Applications Platform: windows Short Name: stckyn Is Parsed: No Sent to Investigation Hub: No Collect File(s): Yes

Background

Microsoft Sticky Notes stores user-created notes in SQLite databases (modern version) or SNT files (legacy version). These notes can contain passwords, reminders, sensitive information, and personal or work-related content.

Data Collected

This collector gathers structured data about microsoft sticky notes.

Collection Method

This collector gathers plum.sqlite database files from the modern Sticky Notes app and legacy .snt files from the Roaming profile directory.

Forensic Value

Sticky Notes often contain valuable information including passwords, account details, IP addresses, system information, and notes related to investigations. They can reveal user intentions, planned activities, and sensitive data exposure.