Skip to content

Commit

Permalink
Worked on LevelDB database format support
Browse files Browse the repository at this point in the history
  • Loading branch information
joachimmetz committed Jan 1, 2024
1 parent 0950a99 commit 8c25309
Show file tree
Hide file tree
Showing 8 changed files with 1,189 additions and 15 deletions.
23 changes: 13 additions & 10 deletions documentation/Apple Spotlight store database file format.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ store file formats specification.
== License

....
Copyright (C) 2020-2023, Joachim Metz <[email protected]>.
Copyright (C) 2020-2024, Joachim Metz <[email protected]>.
Permission is granted to copy, distribute and/or modify this document under the
terms of the GNU Free Documentation License, Version 1.3 or any later version
published by the Free Software Foundation; with no Invariant Sections, no
Expand All @@ -45,6 +45,7 @@ in the section entitled "GNU Free Documentation License".
| Version | Author | Date | Comments
| 0.0.1 | J.B. Metz | June 2020 | Initial version based on earlier notes, with thanks to Everest Munro-Zeisberger
| 0.0.2 | J.B. Metz | June 2023 | Additional changes based on format analysis
| 0.0.3 | J.B. Metz | January 2024 | Small textual changes.
|===

:numbered:
Expand Down Expand Up @@ -437,21 +438,21 @@ The metadata attributes are stored using several property tables.
| Value | Identifier | Description
| 0x00 | | Boolean +
Contains a variable size integer +
See section: <<variable_size_integer,Variable size integer>> +
See section: <<variable_size_integer,Variable-size integer>> +
| 0x01 | | [yellow-background]*Unknown*
| 0x02 | | [yellow-background]*Unknown* +
Contains a variable size integer +
See section: <<variable_size_integer,Variable size integer>> +
See section: <<variable_size_integer,Variable-size integer>> +
Seen in combination with "_kMDItemGroupId"
| 0x03 | | [yellow-background]*Unknown*
| 0x04 | | [yellow-background]*Unknown*
| 0x05 | | [yellow-background]*Unknown*
| 0x06 | | [yellow-background]*Unknown* +
Contains a variable size integer +
See section: <<variable_size_integer,Variable size integer>> +
See section: <<variable_size_integer,Variable-size integer>> +
Seen in combination with "_kStoreMetadataVersion"
| 0x07 | | Variable size integer +
See section: <<variable_size_integer,Variable size integer>> +
| 0x07 | | Variable-size integer +
See section: <<variable_size_integer,Variable-size integer>> +
If the 2nd LSB of the property type is set the value data contains a multi-value. See section <<multi_value,Multi-value>>
| 0x08 | | [yellow-background]*Unknown (Byte or 8-bit integer)*
| 0x09 | | Floating-point 32-bit +
Expand All @@ -471,7 +472,9 @@ See section: <<binary_data,Binary data>>
[yellow-background]*The 2 LSB of the property type indicate if the value references a localized string (0x3), list (0x2) or value (0x1) type*
|===

==== [[variable_size_integer]]Variable size integer
==== [[variable_size_integer]]Variable-size integer

TODO: add description

==== [[multi_value]]Multi-value

Expand Down Expand Up @@ -834,7 +837,7 @@ The dbStr-1.map.data file contains metadata attribute types that consist of:
|===
| Offset | Size | Value | Description
| 0 | ... | | [yellow-background]*Unknown (stream value data size)* +
See section: <<variable_size_integer,Variable size integer>>
See section: <<variable_size_integer,Variable-size integer>>
| ... | 1 | | Value type +
See section: <<metadata_attribute_value_types,Metadata attribute value types>>
| ... | 1 | | Property type
Expand All @@ -850,7 +853,7 @@ The dbStr-2.map.data file contains metadata attribute values that consist of:
|===
| Offset | Size | Value | Description
| 0 | ... | | [yellow-background]*Unknown (stream value data size)* +
See section: <<variable_size_integer,Variable size integer>>
See section: <<variable_size_integer,Variable-size integer>>
| ... | ... | | Metadata attribute value name +
Contains an UTF-8 encoded string with an end-of-string character
|===
Expand All @@ -864,7 +867,7 @@ metadata attribute values that consist of:
|===
| Offset | Size | Value | Description
| 0 | ... | | [yellow-background]*Unknown* +
See section: <<variable_size_integer,Variable size integer>>
See section: <<variable_size_integer,Variable-size integer>>
| ... | ... | | Index data size +
Contains a variable size integer
| ... | ... | | Index array +
Expand Down
Loading

0 comments on commit 8c25309

Please sign in to comment.