NoteStore Lab is a macOS-specific, local Apple Notes recovery toolkit meticulously designed for digital forensics and incident response. It strictly adheres to a 'copy-first' principle, ensuring all operations are performed on copied evidence rather than the live Notes store. This CLI-first tool generates timestamped case outputs, including manifests, reports, and reviewable artifacts, without becoming a hosted platform. It also features a bounded AI copilot for tasks like evidence summarization, triage, and evidence-backed case questioning, making it a powerful workbench for inspecting and safely handing off forensic data.
主要功能
01AI-assisted evidence summarization and triage using derived artifacts.
02Copy-first Apple Notes recovery and forensic review for macOS.
03Evidence-backed case Q&A that cites reviewable sources.
04Local agent access via a read-mostly MCP server (Codex/Claude Code compatible).
050 GitHub stars
06Ability to compare and replay case roots for diagnosis and review.
使用案例
01Conducting digital forensics and incident response on Apple Notes data on macOS.
02Recovering, inspecting, and reviewing copied Apple Notes evidence.
03Integrating local agents (like Codex or Claude Code) for AI-driven analysis of forensic case roots.
