Android ColorNote, notes recovery

So I decided to upgrade the custom Android ROM on my HTC HD2 (Leo), and totally forgot about some of the important notes I left in the Android app ColorNote.

Fortunately before I upgraded my ROM, I made a backup using Clockwork Recovery Mod and saved it to my PC.

So I put my forensics hat on and got to work:

The backup consisted of the following files:

.android_secure.img
boot.img
cache.img
data.img
nandroid.md5
recovery.img
sd-ext.img
system.img

The IMG files are using the Yet Another Flash File System (YAFFS).

A quick Google and I came across this post on the XDA Devs Forums.
(Download the attachment to the forum thread) This is a Cygwin ported version of 'unyaffs'.

Next was to work out which IMG file to use... So I cheated and asked Android guru Noobhands who pointed me at the data.img (Thx dude!).

The 'unyaffs' is simple to use:

unyaffs.exe data.img

This extracts the contents of the IMG to the current folder.

Android apps store data in the "data" folder. Having a large number of apps on my Phone, I now had to work out which folder was actually ColorNote.
The easy way todo this is to look at the Apps ID in Google Market:

https://play.google.com/store/apps/details?id=com.socialnmobile.dictapps.notepad.color.note

Sure enough, the folder is there. Within this folder is the folder "databases".

This folder contains the following:

colornote.db
internal.db
internal.db-shm
internal.db-wal

Quickly examining the .DB files with a Hexeditor I confirmed they were SQLite 3 databases.

So I opened the colornote.db with SQLite Browser, switched to the 'Browse Data' tab, and changed the table to "notes" and sure enough all my missing notes were there! woot! :)

Now what's also interesting, all of my old deleted notes are also still stored, along with the 'create', 'modified', and 'minor modified' dates.