If there’s one piece of non-hacking software I recommend to every security professional I mentor, it’s CherryTree. It’s a free, open-source hierarchical note-taking application, and I’ve used it for years to organize everything from penetration test findings to digital forensics case notes. In this article, I’ll go over what makes CherryTree so useful, how to install and configure it, and how I actually structure notes inside it during real engagements.
What CherryTree Is
CherryTree is a desktop application (written in GTK, with both Python and C++ versions existing historically) that stores notes in a tree structure — think of it like a personal wiki with unlimited nested nodes. Each node can hold rich text, code blocks with syntax highlighting, images, tables, and even embedded file attachments. Everything is saved into a single document file, either as:
- An encrypted or plain SQLite database (
.ctb) - An XML file (
.ctd) - Password-protected variants of both
This single-file storage model is exactly why I like it for engagements — I can hand off, back up, or archive an entire case’s worth of notes as one file.
Installing CherryTree
On Debian/Ubuntu/Kali:
sudo apt update
sudo apt install -y cherrytree
On Fedora:
sudo dnf install -y cherrytree
Verifying the install:
cherrytree --version
It also ships as a Windows installer and a portable version, which I use on client-provided forensic workstations that already run Windows.
Basic Usage and Structure
When I start a new penetration test, my typical CherryTree node structure looks like this:
Client Name
├── Scope & Rules of Engagement
├── Recon
│ ├── Passive OSINT
│ ├── Subdomain Enumeration
│ └── Port Scanning
├── Vulnerabilities
│ ├── SQL Injection - Login Form
│ ├── XSS - Search Field
│ └── Misconfigured S3 Bucket
├── Exploitation
├── Post-Exploitation
└── Reporting Draft
Every node supports:
- Rich text formatting (bold, colors, highlighting) — I use color coding for severity (red for critical findings, yellow for medium).
- Code boxes with syntax highlighting for languages like bash, Python, and SQL — extremely useful for pasting exact commands I ran.
- Tables — I use these for tracking discovered hosts, ports, and services.
- Image embedding — screenshots of proof-of-concept exploitation go directly into the relevant node.
Command-Line Options
CherryTree does have some CLI flags useful for automation and scripting workflows:
cherrytree /path/to/casefile.ctb # open a specific document
cherrytree --export_to_html /path/to/casefile.ctb # export the whole tree to HTML
cherrytree --export_to_pdf /path/to/casefile.ctb # export to PDF
I use the export options heavily at the end of an engagement to generate a raw HTML/PDF dump of my working notes that later gets cleaned up into the client-facing report.
Real-World Use Cases
Penetration testing note management — keeping every command, its output, and screenshots in one hierarchical file makes writing the final report dramatically faster, since I’m not hunting across a dozen scattered text files.
Digital forensics case documentation — I structure a node per piece of evidence (disk image, memory dump, mobile extraction), documenting hash values, chain of custody notes, and tool output directly under each.
Incident response timelines — I build a chronological node tree during an active IR engagement, adding timestamped entries as new evidence emerges, which later becomes the backbone of the incident timeline in the final report.
Integration with Other Tools
- I paste
hashdeep/sha256sumoutput directly into CherryTree nodes for chain-of-custody documentation. - Screenshots from
cutycaptor manual screen captures get dragged directly into relevant vulnerability nodes. - Exported HTML/PDF from CherryTree feeds into report templates built in LibreOffice or Word.
Performance, Troubleshooting, and Best Practices
- Enable password protection (
.ctbencrypted) for any file containing client-sensitive data, and store the password in a proper password manager, not in the file’s own notes. - Periodically use “Export All to a Single HTML/PDF” as a backup snapshot in addition to the native file — useful if the database ever becomes corrupted.
- Very large single files (thousands of nodes with embedded images) can slow down load times; I split long-running engagements into a new file per phase or per month.
- A common mistake: forgetting to enable auto-save intervals in Preferences — I always set this to 1–3 minutes to avoid losing notes after a crash.
FAQ
Is CherryTree cross-platform? Yes — Linux, Windows, and macOS builds are available.
Can I sync CherryTree notes across machines? Since it’s a single file, I sync it through an encrypted cloud folder or a private git repo (careful with binary diffs on .ctb files).
Does it support Markdown? It has import/export support for various formats, though its native format is its own rich-text tree structure rather than plain Markdown.
Summary
CherryTree has been my go-to note-taking backbone for every penetration test and forensic case I’ve worked on. Its hierarchical structure mirrors how a real engagement unfolds — recon, findings, exploitation, evidence — and its single-file portability makes archiving and handoff painless.
References
- Official project page and documentation: https://www.giuspen.net/cherrytree/
- GitHub repository: https://github.com/giuspen/cherrytree
