NoteStore Lab is a specialized toolkit designed for macOS digital forensics, focusing on the recovery and review of copied Apple Notes evidence. It operates strictly on copies to preserve the integrity of the live Notes store, providing a 'lab bench' for investigators. The tool generates timestamped case roots with comprehensive, reviewable outputs including backups, recoveries, verifications, and reports. It integrates advanced AI features for evidence summarization, triage assistance, and a unique 'ask-case' function that provides evidence-backed answers, citing sources from derived artifacts. Furthermore, it offers a read-mostly MCP server, serving as a local agent access surface for builder tooling and AI agent workflows, ensuring privacy and control by staying local-first.
主な機能
01AI-assisted triage and evidence summarization for case roots.
02Evidence-backed case Q&A with citations from derived artifacts.
03Read-mostly MCP server for local agent workflows and builder tooling.
04Generates timestamped case roots with reviewable outputs (reports, manifests, timelines).
05Compares two case roots at the manifest and derived review-surface layer.
060 GitHub stars
