2012-03-10

Android ColorNote, notes recovery

So I decided to upgrade the custom Android ROM on my HTC HD2 (Leo), and totally forgot about some of the important notes I left in the Android app ColorNote.

Fortunately before I upgraded my ROM, I made a backup using Clockwork Recovery Mod and saved it to my PC.

So I put my forensics hat on and got to work:

The backup consisted of the following files:
.android_secure.img
boot.img
cache.img
data.img
nandroid.md5
recovery.img
sd-ext.img
system.img
The IMG files are using the Yet Another Flash File System (YAFFS).
A quick Google and I came across this post on the XDA Devs Forums.
(Download the attachment to the forum thread)
This is a Cygwin ported version of 'unyaffs'.

Next was to work out which IMG file to use... So I cheated and asked Android guru Noobhands who pointed me at the data.img (Thx dude!).

The 'unyaffs' is simple to use:
unyaffs.exe data.img
This extracts the contents of the IMG to the current folder.

Android apps store data in the "data" folder. Having a large number of apps on my Phone, I now had to work out which folder was actually ColorNote.
The easy way todo this is to look at the Apps ID in Google Market:
https://play.google.com/store/apps/details?id=com.socialnmobile.dictapps.notepad.color.note
Sure enough, the folder is there. Within this folder is the folder "databases".
This folder contains the following:
colornote.db
internal.db
internal.db-shm
internal.db-wal
Quickly examining the .DB files with a Hexeditor I confirmed they were SQLite 3 databases.
So I opened the colornote.db with SQLite Browser, switched to the 'Browse Data' tab, and changed the table to "notes" and sure enough all my missing notes were there! woot! :)

Now what's also interesting, all of my old deleted notes are also still stored, along with the 'create', 'modified', and 'minor modified' dates.

11 comments:

  1. thanks a lot..my notes are opened thanks to u bt nt all..some important are password protected what to do with it to open?please help!!!!

    ReplyDelete
  2. @chandan it works without a hitch because colornote.db isn't password protected, the master password is only applied to backup .dat and .idx files.
    A related article: http://danyilbohdan.com/blog/colornotes.html

    ReplyDelete
  3. Apps ID in the Google market is the best. As this is the easiest way to do this completely and flawlessly.

    ReplyDelete
  4. This comment has been removed by the author.

    ReplyDelete
  5. What is the App ID please ?

    ReplyDelete
  6. Hey, I don't have any .db or .img but just .dat and .idx. I suppose the data is in .dat, but I don't know how to open it. Suggestions please? Thank you.

    ReplyDelete
  7. My notes are stored as .DOC files but open all encrypted. How can I read them on the computer?

    ReplyDelete
    Replies
    1. I have the same problem and I am having a hard time, to find an answer anywhere... :/

      Delete
  8. After buying a (renewed) Galaxy s7 to replace my aging s3 I found that if you have a Google account you can sync the old phone then do the same on the new and all of your notes will appear. The old color notes was on my SD card and simply moving it to the new phone did not work

    ReplyDelete
  9. This is my first time i visit here. I found so many interesting stuff in your blog especially its discussion. From the tons of comments on your articles, I guess I am not the only one having all the enjoyment here keep up the good work ανακτηση δεδομενων

    ReplyDelete