wader/fq
1
1
Fork 0
mirror of https://github.com/wader/fq.git synced 2024-11-30 09:58:13 +03:00
Code Issues Projects Releases Wiki Activity
1352598af9
fq/format/applebookmark/apple_bookmark.md

2.0 KiB
Raw Blame History

Apple bookmarkData format

Apple's bookmarkData format is used to encode information that can be resolved into a URL object for a file even if the user moves or renames it. Can also contain security scoping information for App Sandbox support.

These bookmarkData blobs are often found endcoded in data fields of Binary Property Lists. Notable examples include:

  • com.apple.finder.plist - contains an FXRecentFolders value, which is an array of ten objects, each of which consists of a name and file-bookmark field, which is a bookmarkData object for each recently accessed folder location.

  • com.apple.LSSharedFileList.RecentApplications.sfl2 - sfl2 files are actually plist files of the NSKeyedArchiver format. They can be parsed the same as plist files, but they have a more complicated tree-like structure than would typically be found, which can make locating and retrieving specific values difficult, even once it has been converted to a JSON representation. For more information about these types of files, see Sarah Edwards' excellent research on the subject (link in references).

Locating bookmarkData objects in plist files, especially those of the NSKeyedArchiver type, is a place where fq's recursive searching really shines. Here, we recursively descend through the decoded tree, probing for and selecting any bookmark blobs, then converting them to readable JSON with torepr:

fq '.. | select(format=="bookmark") | .map(. | torepr)' com.apple.LSSharedFileList.RecentApplications.sfl2

Authors

References