Passware Kit Standard Plus and higher editions recover passwords for Apple Notes – a default Apple app for taking notes available on iOS, iPadOS, visionOS, and macOS.
- Understanding encryption in Apple Notes
- Apple Notes file default locations
- Using Passware Kit for Apple Notes decryption
- Troubleshooting
Understanding encryption in Apple Notes
By default, Apple Notes are not encrypted, but users can protect individual notes or all notes. There are two protection options:
- Login (Account) password, linked to the Apple Keychain
- Custom Password
Passware Kit supports Brute-force password recovery only for notes encrypted with Custom password.
When creating a new custom password, a user is prompted to add a password hint. Such hints can be useful to setup appropriate password recovery attack settings.
Apple Notes file default locations
macOS
The files needed for password recovery are located at:
/Users/username/Library/Group Containers/group.com.apple.notes/
- NoteStore.sqlite (main)
- NoteStore.sqlite-wal (additional)
- NoteStore.sqlite-shm (additional)
iOS
The location of the files required for password recovery is:
/private/var/mobile/Containers/Shared/AppGroup/B7A0A29-863-464A-B244- D4199FAD 7FA5/NoteStore.sqlite
If the Apple device was previously unlocked using Passware Kit Mobile, the files are located at:
unprotected\userdata\private\var\mobile\Library\Notes\notes.sqlite
If the Apple mobile device was backed up on a Mac, the NoteStore.sqlite file may be found in the following folder:
AppDomainGroup/group.com.apple.notes.
NOTE: Use a 'Backup Manager' software (for example, iMazing or iPhone Backup Extractor) to copy the 'com.apple.notes' (or 'AppDomainGroup-group.com.apple.notes') folder from your backup to PC.
Using Passware Kit for Apple Notes decryption
Apple Notes files can be detected via the free Passware Encryption Analyzer tool or by using the "Find Encrypted Files" option in Passware Kit. If password hint(s) are available, Passware Kit displays them along with the encryption complexity and other relevant information.
Passware Tip: Copy Apple Notes files from the system location to a non-system location so that Passware Kit can access them. We recommend copying the main NoteStore.sqlite file together with the accompanying NoteStore.sqlite-shm and NoteStore.sqlite-wal files.
Passware Kit Business, Forensic and Ultimate editions support batch password recovery for Apple Notes. Passware Kit allows users to select specific notes and set up different attacks depending on the password hint(s) and other information about the missing password. Passware Kit Standard Plus allows password recovery for only one account or note at a time.
Decryption options for each individual Apple Notes file are:
-
Account password
Password set as default for all notes -
Individual note password
Custom password set for individual notes
Account and note names are displayed as they appear in the SQL database, which can present a name, a date, or an internal ID.
Hints are displayed for both the account and individual notes.
NOTE: Not all notes from the Apple Notes file might be listed. Passware Kit analyzes the passwords set for the notes, groups them by type, and displays a single note for each password to unlock.
If an account or note password has already been recovered, it appears in the “Password” column.
The “Not supported” tag is displayed for accounts or notes that might be encrypted with an Account password or contain an unsupported structure.
As a result of the successful password recovery, Passware Kit displays the original password along with any available hints and the note or account name in the file description.
If certain passwords have not been recovered, try different password recovery attack settings. Any previously recovered passwords will appear in the Passwords Found column.
Troubleshooting
Q: Why do I get a “Not supported” message for my Apple Notes file?
Ensure you are using the latest version of Passware Kit. The file might be encrypted with an Account password or have a specific structure which is not currently supported by Passware Kit. Only Custom default passwords are supported for recovery.
Q: Why do I get a “No password is set” message for my Apple Notes file?
The file's structure may differ from the one supported by Passware Kit. Send the file in question to Passware Support for analysis.
Q: Why do I get an “Error while opening the file” message for my Apple Notes file?
Please open the Log tab in the Passware Kit and check the “Failed to open directory” error next to your Apple Notes file location. This usually means the file is in use by the Apple system and Passware Kit cannot access it.
Copy the file to another location and run the password recovery again.
Comments
0 comments
Article is closed for comments.