Sticky Notes - Revision history

Keydet89 at 12:37, 30 August 2011

2011-08-30T12:37:58Z

Keydet89 at 12:35, 30 August 2011

2011-08-30T12:35:10Z

Keydet89: /* Sticky Notes */

2011-08-27T20:58:58Z

‎Sticky Notes

Keydet89 at 20:47, 27 August 2011

2011-08-27T20:47:02Z

Keydet89 at 20:22, 27 August 2011

2011-08-27T20:22:57Z

Keydet89: Created page with "== Sticky Notes == Sticky Notes are a feature of Windows 7 that allows a user to create sticky notes on their desktop. The functionality of this feature is somewhat limited, in..."

2011-08-27T20:22:23Z

Created page with "== Sticky Notes == Sticky Notes are a feature of Windows 7 that allows a user to create sticky notes on their desktop. The functionality of this feature is somewhat limited, in..."

New page

== Sticky Notes ==

Sticky Notes are a feature of Windows 7 that allows a user to create sticky notes on their desktop. The functionality of this feature is somewhat limited, in that the user can change the text, font, color, location and size of the sticky notes, but not much else.

Sticky Notes are maintained in a single file (stickynotes.snt) located in the user's profile ("%UserProfile%\AppData\Roaming\Microsoft\Sticky Notes"). This file is based on the MS [http://msdn.microsoft.com/en-us/library/dd942138%28v=prot.13%29.aspx:OLE/compound file] binary format.

← Older revision		Revision as of 12:37, 30 August 2011
Line 12:		Line 12:

	=== Tools ===		=== Tools ===
		+	Tools that can be used to parse and view the contents of Sticky Notes files include (but are not limited to):
		+
	[http://www.mitec.cz/ssv.html MiTeC Structured Storage Viewer]		[http://www.mitec.cz/ssv.html MiTeC Structured Storage Viewer]
		+
		+	Sticky Notes Parser (found at this [http://code.google.com/p/winforensicaanalysis/downloads/list Google Code] site; Win32 binary command line tool, all times are displayed in UTC format. Output formats include a listing of the available notes, CSV, and TLN format (for inclusion in a timeline). Also displays the modification time of the Root Entry.

← Older revision		Revision as of 12:35, 30 August 2011
Line 10:		Line 10:

	When sticky notes are deleted, the storage streams associated with those notes are removed from the stickynotes.snt file; however, the Version and Metafile streams remain. The Metafile stream format is not documented at this time; however, this stream appears to contain references to the names of the storage streams that contain the sticky notes.		When sticky notes are deleted, the storage streams associated with those notes are removed from the stickynotes.snt file; however, the Version and Metafile streams remain. The Metafile stream format is not documented at this time; however, this stream appears to contain references to the names of the storage streams that contain the sticky notes.
		+
		+	=== Tools ===
		+	[http://www.mitec.cz/ssv.html MiTeC Structured Storage Viewer]

← Older revision		Revision as of 20:58, 27 August 2011
Line 7:		Line 7:
	When sticky notes files are created, an OLE storage stream using a name similar to "e3a17883-cfd8-11e0-8" is added to the stickynotes.snt file. Each storage stream has three file streams associated with it, and for all sticky notes, they are named 0, 1, and 3. The 0 stream contains the rich text format (RTF) "document" for the sticky note, and the 3 stream contains the actual text of the sticky note, in Unicode format.		When sticky notes files are created, an OLE storage stream using a name similar to "e3a17883-cfd8-11e0-8" is added to the stickynotes.snt file. Each storage stream has three file streams associated with it, and for all sticky notes, they are named 0, 1, and 3. The 0 stream contains the rich text format (RTF) "document" for the sticky note, and the 3 stream contains the actual text of the sticky note, in Unicode format.

−	The forensic value of Sticky Notes has yet to be determined or demonstrated. The Root Entry of the OLE format file will have a modification time associated with it, and each of the storage streams the contain the sticky notes will have creation and modification times associated with them. These times are maintained in the [http://msdn.microsoft.com/en-us/library/ms724284%28v=vs.85%29.aspx FILETIME] format~~. These times~~ can be included in a timeline of system activity in order to demonstrate user activity on the system.	+	The forensic value of Sticky Notes has yet to be determined or demonstrated. The Root Entry of the OLE format file will have a modification time associated with it, and each of the storage streams the contain the sticky notes will have creation and modification times (M and B of the MACB times) associated with them. These times are maintained in the [http://msdn.microsoft.com/en-us/library/ms724284%28v=vs.85%29.aspx FILETIME] format, and can be included in a timeline of system activity in order to demonstrate user activity on the system.
		+
		+	When sticky notes are deleted, the storage streams associated with those notes are removed from the stickynotes.snt file; however, the Version and Metafile streams remain. The Metafile stream format is not documented at this time; however, this stream appears to contain references to the names of the storage streams that contain the sticky notes.

← Older revision		Revision as of 20:47, 27 August 2011
Line 3:		Line 3:
	Sticky Notes are a feature of Windows 7 that allows a user to create sticky notes on their desktop. The functionality of this feature is somewhat limited, in that the user can change the text, font, color, location and size of the sticky notes, but not much else.		Sticky Notes are a feature of Windows 7 that allows a user to create sticky notes on their desktop. The functionality of this feature is somewhat limited, in that the user can change the text, font, color, location and size of the sticky notes, but not much else.

−	Sticky Notes are maintained in a single file (stickynotes.snt) located in the user's profile ("%UserProfile%\AppData\Roaming\Microsoft\Sticky Notes"). This file is based on the MS [http://msdn.microsoft.com/en-us/library/dd942138%28v=prot.13%29.aspx OLE/compound file] binary format.	+	Sticky Notes are maintained in a single file (stickynotes.snt) located in the user's profile ("%UserProfile%\AppData\Roaming\Microsoft\Sticky Notes"). This file is based on the MS [http://msdn.microsoft.com/en-us/library/dd942138%28v=prot.13%29.aspx OLE/compound file] binary format. The .snt file can be opened and viewed using the [http://http://www.mitec.cz/ssv.html MiTec Structured Storage Viewer].
		+
		+	When sticky notes files are created, an OLE storage stream using a name similar to "e3a17883-cfd8-11e0-8" is added to the stickynotes.snt file. Each storage stream has three file streams associated with it, and for all sticky notes, they are named 0, 1, and 3. The 0 stream contains the rich text format (RTF) "document" for the sticky note, and the 3 stream contains the actual text of the sticky note, in Unicode format.
		+
		+	The forensic value of Sticky Notes has yet to be determined or demonstrated. The Root Entry of the OLE format file will have a modification time associated with it, and each of the storage streams the contain the sticky notes will have creation and modification times associated with them. These times are maintained in the [http://msdn.microsoft.com/en-us/library/ms724284%28v=vs.85%29.aspx FILETIME] format. These times can be included in a timeline of system activity in order to demonstrate user activity on the system.

← Older revision		Revision as of 20:22, 27 August 2011
Line 3:		Line 3:
	Sticky Notes are a feature of Windows 7 that allows a user to create sticky notes on their desktop. The functionality of this feature is somewhat limited, in that the user can change the text, font, color, location and size of the sticky notes, but not much else.		Sticky Notes are a feature of Windows 7 that allows a user to create sticky notes on their desktop. The functionality of this feature is somewhat limited, in that the user can change the text, font, color, location and size of the sticky notes, but not much else.

−	Sticky Notes are maintained in a single file (stickynotes.snt) located in the user's profile ("%UserProfile%\AppData\Roaming\Microsoft\Sticky Notes"). This file is based on the MS [http://msdn.microsoft.com/en-us/library/dd942138%28v=prot.13%29.aspx:OLE/compound file] binary format.	+	Sticky Notes are maintained in a single file (stickynotes.snt) located in the user's profile ("%UserProfile%\AppData\Roaming\Microsoft\Sticky Notes"). This file is based on the MS [http://msdn.microsoft.com/en-us/library/dd942138%28v=prot.13%29.aspx OLE/compound file] binary format.