Saturday, 10 March 2012

Android ColorNote, notes recovery

So I decided to upgrade the custom Android ROM on my HTC HD2 (Leo), and totally forgot about some of the important notes I left in the Android app ColorNote.

Fortunately before I upgraded my ROM, I made a backup using Clockwork Recovery Mod and saved it to my PC.

So I put my forensics hat on and got to work:

The backup consisted of the following files:
.android_secure.img
boot.img
cache.img
data.img
nandroid.md5
recovery.img
sd-ext.img
system.img
The IMG files are using the Yet Another Flash File System (YAFFS).
A quick Google and I came across this post on the XDA Devs Forums.
(Download the attachment to the forum thread)
This is a Cygwin ported version of 'unyaffs'.

Next was to work out which IMG file to use... So I cheated and asked Android guru Noobhands who pointed me at the data.img (Thx dude!).

The 'unyaffs' is simple to use:
unyaffs.exe data.img
This extracts the contents of the IMG to the current folder.

Android apps store data in the "data" folder. Having a large number of apps on my Phone, I now had to work out which folder was actually ColorNote.
The easy way todo this is to look at the Apps ID in Google Market:
https://play.google.com/store/apps/details?id=com.socialnmobile.dictapps.notepad.color.note
Sure enough, the folder is there. Within this folder is the folder "databases".
This folder contains the following:
colornote.db
internal.db
internal.db-shm
internal.db-wal
Quickly examining the .DB files with a Hexeditor I confirmed they were SQLite 3 databases.
So I opened the colornote.db with SQLite Browser, switched to the 'Browse Data' tab, and changed the table to "notes" and sure enough all my missing notes were there! woot! :)

Now what's also interesting, all of my old deleted notes are also still stored, along with the 'create', 'modified', and 'minor modified' dates.

9 comments:

  1. thanks a lot..my notes are opened thanks to u bt nt all..some important are password protected what to do with it to open?please help!!!!

    ReplyDelete
  2. @chandan it works without a hitch because colornote.db isn't password protected, the master password is only applied to backup .dat and .idx files.
    A related article: http://danyilbohdan.com/blog/colornotes.html

    ReplyDelete
  3. Apps ID in the Google market is the best. As this is the easiest way to do this completely and flawlessly.

    ReplyDelete
  4. This comment has been removed by the author.

    ReplyDelete
  5. Hey, I don't have any .db or .img but just .dat and .idx. I suppose the data is in .dat, but I don't know how to open it. Suggestions please? Thank you.

    ReplyDelete
    Replies
    1. This is the way mine are stored also

      Delete
  6. My notes are stored as .DOC files but open all encrypted. How can I read them on the computer?

    ReplyDelete
    Replies
    1. I have the same problem and I am having a hard time, to find an answer anywhere... :/

      Delete