tag:blogger.com,1999:blog-1264611260322778486.post1477062692664634489..comments2024-01-01T03:51:10.857-05:00Comments on Yogesh Khatri's forensic blog: Reading Notes database on macOSYogesh Khatrihttp://www.blogger.com/profile/03726664886311447808noreply@blogger.comBlogger18125tag:blogger.com,1999:blog-1264611260322778486.post-33129383563065029032022-03-05T22:39:58.458-05:002022-03-05T22:39:58.458-05:00Nice topic, but I got my note data when I ran your...Nice topic, but I got my note data when I ran your query, but it was unreadable.<br />Such, how can I make it so that it's easy to read? Anonymoushttps://www.blogger.com/profile/13754571307861794173noreply@blogger.comtag:blogger.com,1999:blog-1264611260322778486.post-84326565619712420802022-02-12T07:00:12.253-05:002022-02-12T07:00:12.253-05:00You may just be having a version of the Notes app ...You may just be having a version of the Notes app that does not have that field. The Notes app database structure has changed between versions of macOSYogeshhttps://www.blogger.com/profile/08526932165369184069noreply@blogger.comtag:blogger.com,1999:blog-1264611260322778486.post-19088200701647921412021-12-31T17:23:25.292-05:002021-12-31T17:23:25.292-05:00I am new to trying to learn how to navigate the me...I am new to trying to learn how to navigate the metadata of macOS files. Your blog entry has been very helpful! Thank you for that!<br /><br />I am still a newbie at this, so please bear with me with regards to this question: how exactly can I access the ZDATEFORLASTTITLEMODIFICATION data in NoteStore.sqlite? I have been trying to use the SQLite Viewer in https://inloop.github.io/sqlite-viewer/ for that, but not been too successful at it. The SQLite Viewer I am using does not show a ZDATEFORLASTTITLEMODIFICATION column in the ZICNOTEDATA table. I thought that could be because ZDATEFORLASTTITLEMODIFICATION could be within the compressed ZDATA column in ZICNOTEDATA. My ZDATA column seems not to be compressed, though, as it shows entries that are either null or comma-separated lists of integers. What do I need to do to visualize the ZDATEFORLASTTITLEMODIFICATION data if it is not part of ZDATA? In case it is part of ZDATA, how exactly do I extract it from it?<br /><br />Thanks beforehand for your patience! 🙂Felipe Evaristohttps://www.blogger.com/profile/12978239610826136974noreply@blogger.comtag:blogger.com,1999:blog-1264611260322778486.post-30930557645218192342021-12-31T17:20:57.370-05:002021-12-31T17:20:57.370-05:00This comment has been removed by the author.Felipe Evaristohttps://www.blogger.com/profile/12978239610826136974noreply@blogger.comtag:blogger.com,1999:blog-1264611260322778486.post-41162392968086775512020-07-20T15:14:22.169-04:002020-07-20T15:14:22.169-04:00Hi !this is the only page that has the information...Hi !this is the only page that has the information ive been looking for hopefully you can help !! I managed to delete all my notes off icloud yesterday accidentally. I managed to copy those files over before they were overwritten - NotesV7.storedata-wal seems to have all the info as it is 4.1 MB, however when i put the three files back into the library path with the wifi off- they still dont come back - do you have any advice ? my email is micaelamclucas@gmail.com MICAELA MCLUCAShttps://www.blogger.com/profile/07695941922513827234noreply@blogger.comtag:blogger.com,1999:blog-1264611260322778486.post-10484652495681521572019-08-08T10:39:09.780-04:002019-08-08T10:39:09.780-04:00You are welcome!You are welcome!Yogesh Khatrihttps://www.blogger.com/profile/18391374024639697695noreply@blogger.comtag:blogger.com,1999:blog-1264611260322778486.post-86664516957386558762019-08-07T15:30:18.021-04:002019-08-07T15:30:18.021-04:00Thank you soo much I thought my notes were gone fo...Thank you soo much I thought my notes were gone for ever! I was able to restore them using mac_apt Homerhttps://www.blogger.com/profile/01226573010101298344noreply@blogger.comtag:blogger.com,1999:blog-1264611260322778486.post-21240764549939749932019-05-13T18:36:59.175-04:002019-05-13T18:36:59.175-04:00See my savenotes program: https://github.com/bshan...See my savenotes program: https://github.com/bshannon/savenotesUnknownhttps://www.blogger.com/profile/05118268370843106438noreply@blogger.comtag:blogger.com,1999:blog-1264611260322778486.post-61136146009176701902019-05-05T17:29:55.633-04:002019-05-05T17:29:55.633-04:00how can i restore or view note from archive?how can i restore or view note from archive?Anonymoushttps://www.blogger.com/profile/17039041604040311429noreply@blogger.comtag:blogger.com,1999:blog-1264611260322778486.post-10308601102504575242019-03-14T18:01:43.750-04:002019-03-14T18:01:43.750-04:00I want to know that tooI want to know that tooAnonymoushttps://www.blogger.com/profile/07159874528840791512noreply@blogger.comtag:blogger.com,1999:blog-1264611260322778486.post-80816651474974271102019-01-17T18:28:04.092-05:002019-01-17T18:28:04.092-05:00I believe they're stored as "archived&quo...I believe they're stored as "archived" Objective-C objects.<br /><br />It's probably better to continue this discussion in the issue I created:<br />https://github.com/ydkhatri/mac_apt/issues/13Unknownhttps://www.blogger.com/profile/05118268370843106438noreply@blogger.comtag:blogger.com,1999:blog-1264611260322778486.post-60949563872014566592019-01-12T21:32:17.207-05:002019-01-12T21:32:17.207-05:00Hello! Any ideas on how formatting (lists, checkbo...Hello! Any ideas on how formatting (lists, checkboxes, etc) are stored in the ZDATA blob? Thank you!Matthttps://www.blogger.com/profile/11899251131561918147noreply@blogger.comtag:blogger.com,1999:blog-1264611260322778486.post-28460379635421092932019-01-11T12:59:11.668-05:002019-01-11T12:59:11.668-05:00I'm glad it worked out for you!I'm glad it worked out for you!Yogesh Khatrihttps://www.blogger.com/profile/18391374024639697695noreply@blogger.comtag:blogger.com,1999:blog-1264611260322778486.post-14410100013012372592019-01-08T13:57:03.447-05:002019-01-08T13:57:03.447-05:00this post help me to solve problems that is very c...this post help me to solve problems that is very confusing if you look for help in apple forums, so what I did is simple replacement of files in method 2 from backup (disk image) to my running OS everything including links to images where imported, in short replace storedata and sqlite files and that it.<br /><br />thanks you for this post and .i. apple for the supportJhonny Nemonichttps://www.blogger.com/profile/13146556926247494998noreply@blogger.comtag:blogger.com,1999:blog-1264611260322778486.post-61771708516410549022018-12-03T22:43:12.407-05:002018-12-03T22:43:12.407-05:00No, I have not looked into it yet. No, I have not looked into it yet. Yogesh Khatrihttps://www.blogger.com/profile/18391374024639697695noreply@blogger.comtag:blogger.com,1999:blog-1264611260322778486.post-57714067352764885022018-11-30T19:06:00.746-05:002018-11-30T19:06:00.746-05:00The NoteStore.sqlite file seems to contain the not...The NoteStore.sqlite file seems to contain the notes stored in iCloud. When extracting the note data, mac_apt gives a plain text version of the note with newlines replaced by commas. Have you figured out how to get the html version of the note in this case?Unknownhttps://www.blogger.com/profile/05118268370843106438noreply@blogger.comtag:blogger.com,1999:blog-1264611260322778486.post-59994590448561691832018-03-07T18:14:37.374-05:002018-03-07T18:14:37.374-05:00Great, I don't have a Mountain Lion image to t...Great, I don't have a Mountain Lion image to test it, but I will put the change in the code to parse that too. Then there may be a v3 and v5 too somewhere..Yogesh Khatrihttps://www.blogger.com/profile/18391374024639697695noreply@blogger.comtag:blogger.com,1999:blog-1264611260322778486.post-29153107936102517952018-03-01T17:43:13.865-05:002018-03-01T17:43:13.865-05:00Nice work! FYI Mountain Lion has NotesV1.storedata...Nice work! FYI Mountain Lion has NotesV1.storedata, and the table list is the same as NotesV2.storedata.Anonymoushttps://www.blogger.com/profile/08433843733864038978noreply@blogger.com