Skip to content

Commit

Permalink
updated doc with apple reference
Browse files Browse the repository at this point in the history
  • Loading branch information
dgmcdona committed Dec 2, 2022
1 parent 34db9d7 commit dbc6fcc
Showing 1 changed file with 11 additions and 5 deletions.
16 changes: 11 additions & 5 deletions format/bookmark/bookmark.md
@@ -1,4 +1,4 @@
## Apple bookmarkData format
## Apple `bookmarkData` format

Apple's `bookmarkData` format is used to encode information that can be resolved
into a `URL` object for a file even if the user moves or renames it. Can also
Expand All @@ -15,12 +15,17 @@ Property Lists. Notable examples include:
- `com.apple.LSSharedFileList.RecentApplications.sfl2` - `sfl2` files are
actually `plist` files of the `NSKeyedArchiver` format. They can be parsed the
same as `plist` files, but they have a more complicated tree-like structure
than would typically be found. For more information about these types of files,
see [Sarah Edwards'](https://www.mac4n6.com/blog/2016/1/1/manual-analysis-of-nskeyedarchiver-formatted-plist-files-a-review-of-the-new-os-x-1011-recent-items)
than would typically be found, which can make locating and retrieving specific
values difficult, even once it has been converted to a JSON representation.
For more information about these types of files, see
[Sarah Edwards'](https://www.mac4n6.com/blog/2016/1/1/manual-analysis-of-nskeyedarchiver-formatted-plist-files-a-review-of-the-new-os-x-1011-recent-items)
excellent research on the subject.

Locating `bookmarkData` objects in `NSKeyedArchiver` plist files is a place
where `fq`'s recursive searching really shines:
Locating `bookmarkData` objects in plist files, especially those of the
`NSKeyedArchiver` type, is a place where `fq`'s recursive searching really
shines. Here, we recursively descend through the decoded tree, probing for and
selecting any `bookmark` blobs, then converting them to readable JSON with
`torepr`:
```
fq '.. | select(format=="bookmark") | .map(. | torepr)' com.apple.LSSharedFileList.RecentApplications.sfl2
```
Expand All @@ -30,6 +35,7 @@ fq '.. | select(format=="bookmark") | .map(. | torepr)' com.apple.LSSharedFileLi
[@dgmcdona](https://github.com/dgmcdona)

### References
- https://developer.apple.com/documentation/foundation/url/2143023-bookmarkdata
- https://mac-alias.readthedocs.io/en/latest/bookmark_fmt.html
- https://www.mac4n6.com/blog/2016/1/1/manual-analysis-of-nskeyedarchiver-formatted-plist-files-a-review-of-the-new-os-x-1011-recent-items
- https://michaellynn.github.io/2015/10/24/apples-bookmarkdata-exposed/

0 comments on commit dbc6fcc

Please sign in to comment.