From dbc6fccdda916c50f7f90a6056749d3d26f195e2 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 24 Nov 2022 01:07:34 -0600 Subject: [PATCH] updated doc with apple reference --- format/bookmark/bookmark.md | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/format/bookmark/bookmark.md b/format/bookmark/bookmark.md index e6dba323c..19506a785 100644 --- a/format/bookmark/bookmark.md +++ b/format/bookmark/bookmark.md @@ -1,4 +1,4 @@ -## Apple bookmarkData format +## Apple `bookmarkData` format Apple's `bookmarkData` format is used to encode information that can be resolved into a `URL` object for a file even if the user moves or renames it. Can also @@ -15,12 +15,17 @@ Property Lists. Notable examples include: - `com.apple.LSSharedFileList.RecentApplications.sfl2` - `sfl2` files are actually `plist` files of the `NSKeyedArchiver` format. They can be parsed the same as `plist` files, but they have a more complicated tree-like structure - than would typically be found. For more information about these types of files, - see [Sarah Edwards'](https://www.mac4n6.com/blog/2016/1/1/manual-analysis-of-nskeyedarchiver-formatted-plist-files-a-review-of-the-new-os-x-1011-recent-items) + than would typically be found, which can make locating and retrieving specific + values difficult, even once it has been converted to a JSON representation. + For more information about these types of files, see + [Sarah Edwards'](https://www.mac4n6.com/blog/2016/1/1/manual-analysis-of-nskeyedarchiver-formatted-plist-files-a-review-of-the-new-os-x-1011-recent-items) excellent research on the subject. -Locating `bookmarkData` objects in `NSKeyedArchiver` plist files is a place -where `fq`'s recursive searching really shines: +Locating `bookmarkData` objects in plist files, especially those of the +`NSKeyedArchiver` type, is a place where `fq`'s recursive searching really +shines. Here, we recursively descend through the decoded tree, probing for and +selecting any `bookmark` blobs, then converting them to readable JSON with +`torepr`: ``` fq '.. | select(format=="bookmark") | .map(. | torepr)' com.apple.LSSharedFileList.RecentApplications.sfl2 ``` @@ -30,6 +35,7 @@ fq '.. | select(format=="bookmark") | .map(. | torepr)' com.apple.LSSharedFileLi [@dgmcdona](https://github.com/dgmcdona) ### References +- https://developer.apple.com/documentation/foundation/url/2143023-bookmarkdata - https://mac-alias.readthedocs.io/en/latest/bookmark_fmt.html - https://www.mac4n6.com/blog/2016/1/1/manual-analysis-of-nskeyedarchiver-formatted-plist-files-a-review-of-the-new-os-x-1011-recent-items - https://michaellynn.github.io/2015/10/24/apples-bookmarkdata-exposed/