Restoring an individual note from the Notes.app via TM backup

[Speed38]

In Sonoma, the data in our Notes.app is stored here: ~/Library/Containers/com.apple.Notes/Data/Library/Notes/, in three files.

In an attempt to retrieve/restore just one note, if I recovered those three files and, while doing so, opted to keep both the recovered files and the current files, could I then...
• move the current three files to my desktop
• open the Notes.app using the recovered files
• copy the text of the missing Note.
• quit the Notes.app
• remove and replace the recovered three files with the three I moved to my desktop
• restart Notes.app and cut and paste the text I copied into a new note.

If not, anyone know another way?

 

[MarkC426]

deleted
Realised I was talking nonsense…. 🤪

 

[Speed38]

I saw your reply but you deleted it before I had a chance to note that I did not think that, with a .db file, you can pick and choose what to restore. You must, AFAIK, replace the entire .db file

 

[MarkC426]

Apologies, I am not too sure how this works.
If you save a copy of the db on your Mac, you should be able to restore it if the TM one messes up.

 

[bzgnyc2]

In Sonoma, the data in our Notes.app is stored here: ~/Library/Containers/com.apple.Notes/Data/Library/Notes/, in three files.

In an attempt to retrieve/restore just one note, if I recovered those three files and, while doing so, opted to keep both the recovered files and the current files, could I then...
• move the current three files to my desktop
• open the Notes.app using the recovered files
• copy the text of the missing Note.
• quit the Notes.app
• remove and replace the recovered three files with the three I moved to my desktop
• restart Notes.app and cut and paste the text I copied into a new note.

If not, anyone know another way?

I believe that would work. The only other alternative that might work is something complicated directly manipulating the database files (e.g. using the command-line sqlite3 tool to copy the relevant database rows from from the recovered copy to the current). That would require an understanding of the database schema and how Notes uses them and I would only pursue that route if trying to restore/merge thousands of specific notes.

 

[NoBoMac]

Might need to also get Group Containers. But even then might not work as there is a lot going with Notes. Simple search for Notes related folders turns up these:

find . -type d -name '*.*otes'
./Application Support/SyncServices/Local/TFSM/com.apple.Notes
./Application Support/CloudDocs/session/containers/com.apple.notes
./Daemon Containers/2C95EFC8-CB46-4048-B6C7-F583019AF05C/Data/ActionTranscript/com.apple.Notes
./Application Scripts/group.com.apple.notes
./Application Scripts/com.apple.Notes
./Group Containers/group.com.apple.notes
./Containers/com.apple.Notes
./Containers/com.apple.Notes/Data/Library/HTTPStorages/com.apple.Notes
./Containers/com.apple.Notes/Data/Library/Caches/com.apple.Notes

Before doing anything, probably want to sign out Notes in iCloud (or disconnect any network connections to the Mac) to prevent iCloud data syncing/overwriting what you have. And the other direction as well.

 

[chown33]

If it were me, I'd create a new disposable local account, and do all the fiddling with Notes files on that account. If something goes wrong, you can nuke that account and start over. If it goes well, you can recover the note you wanted, put it in a separate file, and hand it off to the real account (maybe use /Users/Shared).

I'd go ahead and use the files pulled from the TM backup, but there's no way I'd even attempt to fiddle with the real Notes files in my real account.

 

[Speed38]

I believe that would work. The only other alternative that might work is something complicated directly manipulating the database files (e.g. using the command-line sqlite3 tool to copy the relevant database rows from from the recovered copy to the current). That would require an understanding of the database schema and how Notes uses them and I would only pursue that route if trying to restore/merge thousands of specific notes.

Many thanks for the input & I will be the first to admit that the sqlite3 tool would be well beyond my ability.
I had another thought:
• At let's say noon, go back a month to retrieve the three .db files from a TM backup.
• Restore them and choose to replace the current files with them.
• Find the note I lost and cut and past the contents into a TextEdit document
• Go back into the TM backup from earlier the same day, say 1000, retrieve those three files, and choose to replace the current files with them.
• Create a new note and paste the saved contents from the TextEdit document.

 

[Speed38]

Might need to also get Group Containers. But even then might not work as there is a lot going with Notes. Simple search for Notes related folders turns up these:

find . -type d -name '*.*otes'
./Application Support/SyncServices/Local/TFSM/com.apple.Notes
./Application Support/CloudDocs/session/containers/com.apple.notes
./Daemon Containers/2C95EFC8-CB46-4048-B6C7-F583019AF05C/Data/ActionTranscript/com.apple.Notes
./Application Scripts/group.com.apple.notes
./Application Scripts/com.apple.Notes
./Group Containers/group.com.apple.notes
./Containers/com.apple.Notes
./Containers/com.apple.Notes/Data/Library/HTTPStorages/com.apple.Notes
./Containers/com.apple.Notes/Data/Library/Caches/com.apple.Notes

Before doing anything, probably want to sign out Notes in iCloud (or disconnect any network connections to the Mac) to prevent iCloud data syncing/overwriting what you have. And the other direction as well.

EXCELLENT advice about signing out of iCloud so you don't screw up the Notes on my iCloud account and thus in my iPhone and iPad too!!

 

[MarkC426]

I thought I would have a look myself what can be seen in TM, based on your post.
I discovered on my TM backups, none of them are accessible.

There are dates going back 12 months but no way to select/scroll through….. 🤨
Maybe because I upgraded to Sonoma a couple of weeks ago and need to do a new complete backup….?

However….if I use finder I can browse through the backups fine..🤔
Seems to be an issue (another Sonoma blip) with the TM gui.

 

[Speed38]

I thought I would have a look myself what can be seen in TM, based on your post.
I discovered on my TM backups, none of them are accessible.

When you say "accessible" do you mean you can't open them, right?

 

[MarkC426]

I thought I would have a look myself what can be seen in TM, based on your post.
I discovered on my TM backups, none of them are accessible.

When you say "accessible" do you mean you can't open them, right?

Yep, all the dates are listed.
I know in Ventura it worked fine, you could scroll through the dates.

 

[Speed38]

Good grief, what have I done? On my iMac, ALL of my notes appear to be gone.

On my 2020 iMac running Sequoia, I first quit Notes.app & turned off iCloud Note syncing as suggested.

I went to ~/Library/Containers/com.apple.Notes/Data/Library/Notes/, then to Browse Time Machine Backups, then to 01 September, where I selected the three folders at the end of that path and opted to replace the three existing three files.

I then opened Notes and saw what you see below.

I then went back to ~/Library/Containers/com.apple.Notes/Data/Library/Notes/, opened TM, browsed to yesterday at 1300, where I selected the three folders at the end of that path and opted to replace the three existing three files...and again got 0 notes.

I would sincerely appreciate some suggestions of how to recover these notes...of which there are SO many that I would hate to lose.

 

[bzgnyc2]

Good grief, what have I done? On my iMac, ALL of my notes appear to be gone.

On my 2020 iMac running Sequoia, I first quit Notes.app & turned off iCloud Note syncing as suggested.

I went to ~/Library/Containers/com.apple.Notes/Data/Library/Notes/, then to Browse Time Machine Backups, then to 01 September, where I selected the three folders at the end of that path and opted to replace the three existing three files.

I then opened Notes and saw what you see below.

I then went back to ~/Library/Containers/com.apple.Notes/Data/Library/Notes/, opened TM, browsed to yesterday at 1300, where I selected the three folders at the end of that path and opted to replace the three existing three files...and again got 0 notes.

I would sincerely appreciate some suggestions of how to recover these notes...of which there are SO many that I would hate to lose.

1. Hopefully your iCloud retained a copy of your latest?
2. Have you tried rebooting? I hate to suggest that normally but in this case I noticed that background processes keep the Notes sqlite database open. So by overwriting one version while the original is open elsewhere may lead to this situation.
3. Can you restore each set of 3 files (the one set you're trying to restore and your more recent set) to a different location? It may be necessary to move them into place manually rather than straight restore from backup

 

[Speed38]

Sorry, I should have said that I tried rebooting. No joy.

I just checked my iPad and iCloud.com and the notes are all intact.

May I trouble you to elaborate on what you mean when you say "restore these to a different location"?

Do you, for instance, mean find those three files in yesterdays TM backup and manually drag them to the desktop? Is that possible and if so, what then?

Also, I searched and found on Perplexity.ai the claim that the files I want are actually here: ~/Library/Group Containers/group.com.apple.notes/

What have I done???!!!

 

[Speed38]

OK. Quit notes; turned iCloud sync back on; saw the iCloud gear spinning; a few minutes later, all my notes were restored on my iMac. Phew!

 

[MarkC426]

Did you end up getting your missing notes from your Time Machine backup (the original query)…..?

 

[Speed38]

I volunteer to help seniors experiencing problems with or trying to learn how to use any Apple device. I am always on their case to buy an external drive and set up Time Machine explaining how, in addition to having a full backup of their internal HD, they can go back in time and recover old files, folders, documents, etc.

So, can anyone spot what went wrong with this attempt to recover the files associated with Notes? It should be possible...so what went wrong? Was I replacing the wrong files? Must have been or why would Notes have opened to zero notes when launched after those three files had been restored. I am so glad I wasn't walking some senior through this over a Zoom session.

 

[NoBoMac]

Guessing lucked out as these magical folders and databases rely on unique ids and whatnots, so, partial restore caused mismatches, hence looked like new/clean install to sync process and pulled everything from iCloud vs trying to sync Mac changes (read: toasted) to iCloud.

So maybe just delete the folder instead of TM restore would have "flagged" as "new" instance? Pure speculation on my part.

Sad Apple does not have some sort of easier backup ability for Notes (Calendar, Reminders, Contacts have various archive, export, and or iCloud restore options). Best one can do is a roll-your-own solution via Shortcuts or AppleScript to snapshot Notes occasionally, something to copy/paste from.

 

[Speed38]

Did you end up getting your missing notes from your Time Machine backup (the original query)…..?

I did not, it was toggling Notes' iCloud syncing back on that did it. That recovered all my notes...but of course I am still missing the one note that started me on this journey in the first place.

 

[bzgnyc2]

I volunteer to help seniors experiencing problems with or trying to learn how to use any Apple device. I am always on their case to buy an external drive and set up Time Machine explaining how, in addition to having a full backup of their internal HD, they can go back in time and recover old files, folders, documents, etc.

So, can anyone spot what went wrong with this attempt to recover the files associated with Notes? It should be possible...so what went wrong? Was I replacing the wrong files? Must have been or why would Notes have opened to zero notes when launched after those three files had been restored. I am so glad I wasn't walking some senior through this over a Zoom session.

I think I missed that the note you want is in Notes/iCloud rather than On My Mac. Then I now understand that you are trying restore your Mac's sync of notes from iCloud, copy the note, and then paste back into your Notes/iCloud.

That may be possible but doing so man be more complicated due to iCloud. I'd like to help figure this out but since I don't use iCloud nor yet Sonoma, I'm less likely to steer you wrong if I create a test environment to replicate first. Which I probably can't do until at least next week if not the week after...

Just to confirm, this note is more than 30 days old, deleted from your Recently Deleted folder, and/or overwritten rather than just deleted?

 

[Speed38]

I think I missed that the note you want is in Notes/iCloud rather than On My Mac. Then I now understand that you are trying restore your Mac's sync of notes from iCloud, copy the note, and then paste back into your Notes/iCloud.

That may be possible but doing so man be more complicated due to iCloud. I'd like to help figure this out but since I don't use iCloud nor yet Sonoma, I'm less likely to steer you wrong if I create a test environment to replicate first. Which I probably can't do until at least next week if not the week after...

Just to confirm, this note is more than 30 days old, deleted from your Recently Deleted folder, and/or overwritten rather than just deleted?

Yes, the note is more than 30 days old, long gone from the Recently Deleted folder.
To repeat/summarize:

• I thought that if I could discover which ~/Library folders contained the files used by Notes.app, I could go back 3 months in TM and recover them.
• After recovering the state of the Notes.app from that TM backup, I could cut and paste the contents of that lost Note and save them.
• My final step would be to once again enter TM, find the files in those same ~/Library folders, and restore Notes.app to what it was earlier the same day. That way my notes would be up to date and complete
• This failed miserably because I restored the wrong files. :-(. I was able to recover from my mistake because I had begun by turning off iCloud sync for Notes. When I turned iCloud sync for Notes back on, all my notes were repopulated from the iCloud backup.
• In this thread, someone suggested that the files I needed were .sqlite files. and I used Find Any File to locate all the .sqlite files on my Mac and then narrowed it down to these three files: NoteStore.sqlite-wal, NoteStore.sqlite-shm, & NoteStore.sqlite. Here is the path to their location:
/Users/bobg/Library/Group Containers/group.com.apple.notes.
• I think these are the files I should have recovered, but am not certain.

 

[bzgnyc2]

Yes, the note is more than 30 days old, long gone from the Recently Deleted folder.
To repeat/summarize:

• I thought that if I could discover which ~/Library folders contained the files used by Notes.app, I could go back 3 months in TM and recover them.
• After recovering the state of the Notes.app from that TM backup, I could cut and paste the contents of that lost Note and save them.
• My final step would be to once again enter TM, find the files in those same ~/Library folders, and restore Notes.app to what it was earlier the same day. That way my notes would be up to date and complete
• This failed miserably because I restored the wrong files. :-(. I was able to recover from my mistake because I had begun by turning off iCloud sync for Notes. When I turned iCloud sync for Notes back on, all my notes were repopulated from the iCloud backup.
• In this thread, someone suggested that the files I needed were .sqlite files. and I used Find Any File to locate all the .sqlite files on my Mac and then narrowed it down to these three files: NoteStore.sqlite-wal, NoteStore.sqlite-shm, & NoteStore.sqlite. Here is the path to their location:
/Users/bobg/Library/Group Containers/group.com.apple.notes.
• I think these are the files I should have recovered, but am not certain.

Yes, we're now far enough away from what I've actually done previously / my current environment that we've gone from what I think will work to that's what I would try next. Definitely keep making sure you have the backups to undo anything you do...

As I was already planning to create a Sonoma test environment over the holidays that would be the proper place for me to mess around with all this. Unfortunately I somehow physically broke the USB stick I was planning to use for that and will probably be another week before I get a new one all configured and such...

 

[MarkC426]

I thought I would have a look myself what can be seen in TM, based on your post.
I discovered on my TM backups, none of them are accessible.

There are dates going back 12 months but no way to select/scroll through….. 🤨
Maybe because I upgraded to Sonoma a couple of weeks ago and need to do a new complete backup….?

However….if I use finder I can browse through the backups fine..🤔
Seems to be an issue (another Sonoma blip) with the TM gui.

I did some searching, and found this older thread.
If you have a finder window open looking at your TM drive, then select Time Machine, you can scroll back as normal.

Post number 4 below

Post in thread 'Time Machine not working to see back in time'
https://forums.macrumors.com/thread...ing-to-see-back-in-time.2399852/post-32413980

 

[NoBoMac]

Gonna put this one here. Basic outline to save the text from all Notes in Notes.app. Doesn't save locked notes, does not do attachments, and does not save names/titles, but at least saves the text from. Can be adapted for to fit one's needs and can be easily called from an Automation in i*OS to automagically do a snapshot of one's Notes.