It’s my understanding that iCloud notes are usually GZip’d in notestore.sqlite databases on Mac and due to their compressible nature with proprietary algorithm by Apple.
Does Encase / Blackbag parse these files? Which files does Encase/Blacklight parse? I think there needs to be more transparency about it. There’s so many different file types stored on Mac just for notes which was divulged in the post here
https://
The Note content created on Mac usually resides on
NotesVX.storedata
Notestore.sqlite-wal (what’s different about this file)
Notestore.sqlite-shm (what’s different about this also?)
What I also want to know do these Forensic software allow keyword searching on these databases?