Decrypt locked Apple Notes on iOS 16.X

How to Decrypt Locked Apple Notes on iOS 16.x

Unlock protected Apple Notes on iOS 16 with a forensic-grade, step-by-step workflow using open-source tools. This guide walks digital investigators through real-world techniques for recovering encrypted note content — even when commercial tools fall short.

• • Extract key metadata from NoteStore.sqlite and identify locked entries
• • Crack user-set note passwords using Hashcat
• • Derive and unwrap AES keys with Python or CyberChef
• • Decrypt and decompress the BLOB to recover the original plaintext note
• • Explore GZIP and Protobuf data structures in encrypted Apple Notes

This method is built for mobile forensic professionals, lab analysts, and investigators dealing with encrypted app data on Apple devices. You’ll use tools like:

• • DB Browser for SQLite – to locate and extract crypto fields
• • CyberChef – for key derivation, AES unwrapping, and decoding
• • Python scripts – to automate key operations (available on GitHub)

Note: This method applies to iOS 16.x only. Apple has significantly changed Notes encryption in iOS 17 and 18.

Why It Matters

Locked Apple Notes often contain key evidence. Unlike default tool parsing, this approach helps you:

• • Manually validate findings
• • Document cryptographic structure for reporting or court
• • Work around limitations of standard forensic tools

Resources & Scripts

notes_to_hashcat.py
get_kek.py
unwrap.py

Whether you're writing reports or prepping for CTFs, this guide arms you with technical workflows to dig deeper into encrypted Apple Notes. For forensic consultants and professionals who demand control over every byte of evidence.