Notepad.exe Will Snitch On You (full coding project)

Windows 11's Notepad app saves unsaved tab data in binary cache files that can be extracted for digital forensics or security purposes 0:00-0:33.

Key Takeaways:
• Notepad tabs are cached in %localappdata%\Packages\Microsoft.WindowsNotepad_*\LocalState\tabState\ as .bin files 1:39-2:34
• Cache files contain plain text content even for unsaved files, creating potential security artifacts 0:47-1:10
• Binary files use a specific structure with magic bytes "NP" and content in UTF-16 encoding 11:55-12:36
• Files can be parsed using tools like strings.exe or custom Python scripts to extract file paths and content 3:55-4:37
• This creates valuable artifacts for digital forensics, incident response, and penetration testing 1:15-1:30

This caching mechanism creates both privacy concerns and valuable investigation artifacts 8:01-8:07.

Sources:

• 0:00-0:33 Introduction to Windows 11 Notepad tab caching feature
• 1:39-2:34 Location and structure of cache files in tabState directory
• 3:55-4:37 Extracting content from binary files using strings.exe
• 11:55-12:36 Binary file structure analysis with magic bytes
• 1:15-1:30 Security implications for forensics and testing