Notepad TabState Forensics Cheat Sheet

What it is

The Store version of Notepad shipped with Windows 11 added tabs and, from 2023, session restore: when Notepad closes, open tabs (saved or not) come back on the next launch. To do that it continuously writes each tab to a binary file under TabState. For investigators this is unusual evidence: text the user typed or pasted without ever saving it is sitting on disk, together with the path of files that were open.

The feature appeared in Notepad app versions released through the Windows 11 Store during 2023 (version numbers in the 11.23xx range are commonly cited). Windows 10's classic notepad.exe does not have it.

Location

Item	Path (under `%LOCALAPPDATA%\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\LocalState\`)
Tab files	`TabState\<GUID>.bin`
Tab auxiliary state	`TabState\<GUID>.0.bin`, `<GUID>.1.bin` (settings and pending edits, per community research)
Window layout	`WindowState\*.bin` (tab order, active tab, window geometry)
App settings	`..\Settings\settings.dat` (package root, registry-format hive)

What it proves

Proves the content of each open tab at the last write, including unsaved "Untitled" tabs: pasted credentials, draft messages, command lists, ransom notes being edited.
Proves a file was open in Notepad (full path) and, via the embedded hash and timestamp, what version of that file was loaded.
Shows unsaved edits made on top of a saved file, which may differ from the file on disk.
It does not give a typing timeline: there is no per-keystroke time, only file-level times.
It does not prove the text was authored by the user; it could have been pasted from elsewhere. Correlate with clipboard history.

Key fields

The format is undocumented and was reverse-engineered by the community; field order and types can change between Notepad versions.

Field	Meaning
Magic `NP`	File signature
Saved / unsaved flag	Whether the tab is backed by a file on disk
File path	Full path of the saved file (UTF-16LE, length-prefixed)
File size, encoding, line-ending type	Properties of the saved file
Last write time	Timestamp of the saved file when loaded
SHA-256	Hash of the file content as loaded
Selection start / end	Cursor or selection position
Content	Tab text (UTF-16LE)
Unsaved chunks	Appended insert/delete operations with CRC32 checksums

Lengths and several numeric fields are stored as variable-length unsigned LEB128 integers, which is why naive string searches only give partial results.

Timestamps

Timestamp	Format	Notes
Embedded file last write time	FILETIME, UTC (LEB128-encoded per community write-ups)	Describes the file on disk, not the typing
`.bin` $SI creation	NTFS, UTC	Approximately when the tab was opened
`.bin` $SI modification	NTFS, UTC	Last time Notepad flushed the tab, close to the last edit
`WindowState` files	NTFS, UTC	Last change of the tab layout

Retention and clearing

Tab files persist across reboots until the tab is closed. Closing a tab (and choosing not to save) deletes its .bin files.
Users can disable restore in Notepad settings (When Notepad starts: start a new session); tab files are then no longer kept after Notepad closes (exact behaviour may vary by version).
Deleted tab files can be recovered from shadow copies or carved from unallocated space using the NP signature and UTF-16 text.
Uninstalling or resetting the Notepad app wipes the whole LocalState folder.

Collection

$np = "$env:LOCALAPPDATA\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\LocalState"
robocopy "$np" E:\case\notepad /E /COPY:DAT /DCOPY:T
Get-AppxPackage Microsoft.WindowsNotepad | Select-Object Name, Version

Record the Notepad package version: it tells you which format variant to expect. For all profiles, collect C:\Users\*\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\LocalState\ with your triage tool.

Parsing tools

Community parsers: several open-source Python, Rust and C# TabState parsers exist on GitHub. Check which Notepad versions each supports before trusting its output.
010 Editor / hex editor: for a first look, the UTF-16LE text is readable directly; templates from community research help decode fields.
Strings: strings -el on the .bin files quickly surfaces unsaved text.
Plaso / commercial suites: support is recent and uneven; verify against manual parsing.

Investigation tips

Always check unsaved tabs first: users paste passwords, API keys, IP lists and chat drafts into "Untitled" tabs and never save them.
Compare the embedded SHA-256 with the current file on disk: a mismatch means the file changed after it was opened in Notepad.
In ransomware cases, attackers staging notes or command lists in Notepad on a compromised host leave them here.
Correlate paths with jump lists and RecentDocs for when files were opened.
The same principle applies to other apps with session restore; compare with Sticky Notes.

Notepad TabState (Windows 11)

Tools