Sticky Notes (plum.sqlite and StickyNotes.snt)

What it is

Sticky Notes is the Windows desktop note app. Users paste passwords, access codes, phone numbers, to-do lists and account details into it, which makes it a small but high-value artifact in insider, fraud and intrusion cases.

Two storage generations exist. Windows 7 up to Windows 10 before build 1607 kept all notes in StickyNotes.snt, an OLE compound file. From Windows 10 1607 (Anniversary Update) the Store app Microsoft.MicrosoftStickyNotes stores notes in plum.sqlite, a SQLite database that can also sync with the user's Microsoft account.

Location

Recent edits often sit in plum.sqlite-wal until a checkpoint, so always collect the three files together (SQLite WAL).

What it proves

• Content: the exact text the user typed into each note, including text later closed or hidden on screen.
• Timing: when each note was created and last updated (and marked deleted, if applicable).
• Use of the account: synced notes (LastServerVersion populated) indicate a Microsoft account was signed in to the app.
• It does not prove when a note was read, and synced notes may have been written on another device: CreatedAt is local to the database copy, and LastServerVersion reflects the server, not this PC.

Key fields

Other tables in plum.sqlite include User, Media, Stroke (ink) and Insight.

For StickyNotes.snt, each note is a storage whose streams hold the note as RTF (stream 0) and as Unicode text (stream 3).

Timestamps

Retention and clearing

• There is no size-based rollover: notes persist until the user deletes them.
• Deleting a note removes its row or storage; remnants can survive in plum.sqlite-wal, SQLite free pages and unallocated space. In .snt files, deleted notes lose their storages but the Metafile stream may still reference them.
• With cloud sync enabled, deleted notes may still exist in the user's Microsoft account and on other devices.
• Resetting or uninstalling the app deletes the LocalState folder; look in volume shadow copies for older versions.

Collection

• KAPE target: MicrosoftStickyNotes (collects plum.sqlite* from the app package). Its legacy path is %APPDATA%\Microsoft\StickyNotes\ without a space, so it can miss StickyNotes.snt in Sticky Notes\: copy that file manually on older systems.
• Velociraptor (Windows.Triage.Targets): MicrosoftStickyNotes (same globs).
• Built-in: close the app so the WAL is checkpointed, or copy all three files together.

robocopy C:\Users\alice\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalState E:\case\StickyNotes plum.sqlite* /COPY:DAT
robocopy "C:\Users\alice\AppData\Roaming\Microsoft\Sticky Notes" E:\case\StickyNotes StickyNotes.snt /COPY:DAT

Parsing tools

• SQLECmd (Eric Zimmerman): the MicrosoftStickyNotes map converts ticks and exports the Note table to CSV.
• StickyParser (open source): parses both .snt and plum.sqlite and attempts recovery of deleted content from SQLite.
• DB Browser for SQLite: open a working copy with the -wal beside it and query Note directly.
• MiTeC Structured Storage Viewer (free): browse .snt storages and streams.

Investigation tips

• Grep note text for credentials, URLs, IP addresses, crypto wallet addresses and ransom contacts.
• Compare the WAL content with the main database: a note present only in the WAL can be a very recent edit or a deleted note.
• Convert ticks carefully: a naive FILETIME conversion lands the dates centuries off.
• Line up CreatedAt/UpdatedAt with the Windows Timeline, clipboard history and logon sessions to attribute a note to an interactive session.
• If cloud sync is on, ask for the Microsoft account data; the local copy may not include notes created elsewhere.