Filesystem:/Applications/MobileNotes.app

Notes is the built-in system application to take quick text notes. To backup or restore the data of this application without iTunes, the following information might be useful. Initial data for this analysis comes from an iPhone 3GS with firmware 3.1.3, which was later restored / upgraded to an iPhone 4 and finally to an iPhone 4S with iOS 5.0.1. On lower or higher firmware versions there might be small differences in the data.

In the folder  there are two files: The second file is probably used for indexing and can be recreated if deleted (?). Looking at the file, this is an SQLite database with the following tables in it: The name2 in this list is the value used for the hash in NSStoreModelVersionHashes in the bplist of the field Z_PLIST in the table Z_METADATA. The same name2 is used in the table Z_PRIMARYKEY, field Z_NAME.

The following indexes are defined:

sqlite_master
This table is contained in every SQLite database and contains general information about the content. It has these fields:

This is the content of this table: Please note that the values for rootpage might differ in every database.

Z_PRIMARYKEY
This is used by the framework and holds an entry for every table. These are the fields in there:

Z_METADATA
This table is used by the framework and holds configuration data. There is only one record in the table.

The bplist holds this data: * data, base64 encoded 32-byte hash (calculation?)
 * LastIndexTidAlreadySetUp=true
 * LocalAccountAndStoreAlreadySetUp=false
 * NSPersistenceFrameworkVersion=386
 * NSStoreModelVersionHashes=dict:
 * Account=*
 * NextId=*
 * Note=*
 * NoteBody=*
 * NoteChange=*
 * Property=*
 * Store=*
 * NSStoreModelVersionHashesVersion=3
 * NSStoreModelVersionIdentifiers=array:
 * (one empty string)
 * NSStoreType=SQLite

ZSTORE
This table has only one record in it.

ZACCOUNT
This table has only one record in it. Maybe these entries define different iTunes users. (?)

ZNEXTID
This table has only one record in it.

ZPROPERTY
This table contains three rows.

ZNOTE
This table contains general infos about each note. There is one record for every note. For the two date / time fields in this table: This is a floating point number and indicates the number of seconds since 1 January 2001.

ZNOTEBODY
This table contains general infos about each note. There is one record for every note.

ZNOTECHANGE
The purpose of this table is unknown. It is probably related to changes and synchronization.

Convert
A script for converting a notes.sqlite file into a usable series of text files:

set -e
 * 1) !/bin/bash

function adjust { date -j -f '%Y-%m-%d %H:%M:%S' "$1" +'%m/%d/%Y %H:%M:%S' }

rm -rf notes.d mkdir -p notes.d

sqlite3 notes.sqlite 'select z_pk as id, datetime(zcreationdate + 978307200, "unixepoch", "localtime") as created, datetime(zmodificationdate + 978307200, "unixepoch", "localtime") as modified, ztitle as title from znote ' | while IFS='|' read -r id created modified title; do   file=notes.d/"$id".html sqlite3 notes.sqlite 'select zcontent from znotebody where zowner = '"$id" >"$file" SetFile -d "$(adjust "$created")" -m "$(adjust "$modified")" "$file" title=${title//[\/:.]/_} mv "$file" notes.d/"$id - ${title:0:$((260-${#file}))}".html done