offer to assist in file deconstruction free of charge

I would be interested if you could parse out bcache22.bmc (the bitmap cache file used to support remote desktop sessions).

Interesting….The stickynote format is known as a Structred Storage format. the problem is with most viewers they do not show the fragmented deleted information still in the list. I will try to write a viewer to find this info.

The term used in the white paper that I presented last month at Techno Forensics is "Compound Document". http//en.wikipedia.org/wiki/Compound_document

You can view compound files with - CFX – Compound File Explorer www.coco.co.uk/developers/CFX.html

Remember of course that there can be file slack inside the .SNT file, and you can view that as easily as opening the file in a text editor, since the meaningful text is in Unicode, which will just look like spaced out text, and stickies are simply a method of storing text.

I think Ill write my own app, will be a challenge but I think I can make it auto record the slack aswell. and @pbobby Ill take a look at that file structure next for you. 😉

ttyl time for bed here.
Ryan

Cheers Ryan, much appreciated.

I have been watching this thread grow and it is amazing to see the generous nature of those offering help and apps, particularly xaberx. I am really very impressed. Well done guys and thank you for giving of your time and contributing.

just a status update on the Structured Storage file used in Sticky notes for windows…. and I must say this file system is very messy… so far i have the first 2221 bytes mapped out and identified that each sticky note has a unique ID and its own timestamps… I have located a great viewer to help verify what I have found thus far called SSview located at http//www.mitec.cz/

However this viewer cannot see deleted msg residue which is the reason I must do a hex deconstruction of the file and cannot use typical structure readers….. Shouldn't be too bad as I have a mapped the first portion of the file and will just need to make comparisons to determine the unknown values such as offset information and how to piece together the Meta data fragments.

xaberx FYI

Actually the sticky notes snt Structured Storage is an OLE Compound File.

The term Structured Storage seems to be used for different types of implementations.
http//msdn.microsoft.com/en-us/library/aa378734%28v=VS.85%29.aspx

Microsoft has an official specification of the OLE Compound File
http//download.microsoft.com/download/0/B/E/0BE8BDD7-E5E8-422A-ABFD-4342ED7AD886/WindowsCompoundBinaryFileFormatSpecification.pdf

Also see http//www.forensicswiki.org/wiki/OLE_Compound_File

With olecfexport (pre alpha) I was able to extract the following streams

StickyNotes.snt.export/
|– aaaaaaaa-bbbb-cccc-a
| |– 0
| | `– StreamData.bin (contains RTF)
| |– 1
| | `– StreamData.bin (unknown)
| `– 3
| `– StreamData.bin (UTF-16LE text)
|– Metafile
| `– StreamData.bin (seems to contain info about the data streams)
`– Version
`– StreamData.bin (32-bit little-endian version nr. 0x0002)

You might want to check the behaviour of the how the .snt is written, by the sticky notes application. If the file is entirely rewritten the deleted data is probably gone. If the file is accessed as originally intended it can still contain the deleted data and/or slack data.