search

threeplanetssoftware / apple_cloud_notes_parser

Parser for Apple Notes data stored on the Cloud as seen on Apple handsets
MIT License
411 stars 26 forks source link

Image missing due to not having file reference point #66

Closed jareware closed 1 year ago

jareware commented 1 year ago

All my images are missing, replaced with:

Image missing due to not having file reference point

Is this because I'm running the script with --file, and not from an iTunes backup? Went through the README and searched issues, but couldn't figure it out.

This script is a life-saver by the way, thanks so much! 🙌 Sent a few bucks your way. 🙇

threeplanetssoftware commented 1 year ago

Thank you! You are correct, when you run this script on just the NoteStore file itself, it has no way of finding the images because it doesn't know where they are rooted at, or even if they exist.

The different ways this can be run are against a file, a physical backup folder, a MacOS Notes folder, and an iTunes (or Finder) backup folder. Any of the three that aren't file would have the right information to try to find and insert the images into the output.

File (What you do today)

  1. -f | --file FILE: Tells the program to look only at a specific file that is identified.

This is useful if you just happen to have the NoteStore.sqlite file itself. It is odd to have this without one of the below methods also be useful. For example, if you had a NoteStore.sqlite file located in /home/user/phone_rips/iphone/files/NoteStore.sqlite you would run: ruby notes_cloud_ripper.rb -f /home/user/phone_rips/iphone/files/NoteStore.sqlite

Itunes / Finder Backup

  1. -i | --itunes-dir DIRECTORY: Tells the program to look at an iTunes backup folder.

This is useful if you are using Finder (or previously iTunes) to make a local backup of your phone. For example, if you had an iTunes backup located in /home/user/phone_rips/iphone/[deviceid]/ (Which means the Manifest.db is located at /home/whatever/phone_rips/iphone/[deviceid]/Manifest.db) you would run: ruby notes_cloud_ripper.rb -i /home/user/phone_rips/iphone/[deviceid]/

MacOS Notes Folder

  1. -m | --mac DIRECTORY: Tells the program to look at a folder from a Mac.

This is useful if you are looking at Notes on a Mac, or have Cloud syncing turned on for the account on both the phone and the Mac. For example, if you were running this on data from a Mac used by 'Logitech' and had the full file system available, you would run: ruby notes_cloud_ripper.rb -m /Users/Logitech/Library/Group Containers/group.com.apple.notes/

Physical Backup

  1. -p | --physical DIRECTORY: Tells the program to look at a physical backup folder.

This is useful if you have a forensics backup of the device, or have jailbroken it somehow to copy the files off. For example, if you had a physical backup located in /home/user/phone_rips/iphone/physical/ (Which means the phone's /private directory is located at /home/whatever/phone_rips/iphone/physical/private/) you would run: ruby notes_cloud_ripper.rb -p /home/user/phone_rips/iphone/physical

Closing as there isn't a clear bug or feature issue, just general guidance. I hope this helps!

jareware commented 1 year ago

Ah, of course! The --mac mode works beautifully! Thanks again. 🙇