How to read NSCR1000 data files?

Question

Terminal app on OSX stores the information about its windows and content in its state files in Library/Saved Application State/com.apple.Terminal.savedState.

I did the backup of the file before the crash to be able to restore my data, but I don't know how to read it now (as Terminal refuses to use it). It starts with: NSCR1000 as below:

$ hexdump -Cn8 ~/Library/Saved\ Application\ State/com.apple.Terminal.savedState/data.data
00000000  4e 53 43 52 31 30 30 30                           |NSCR1000|

It's used by windows.plist file which can be decoded by:

plutil -convert xml1 -o windows.plist windows.plist

What kind of method I can use to read that .data file? Or where do I start?

$ strings data.data | head -10
NSCR1000
p+5v
0>[t
kJX6X
@NSCR1000

This file is automatically generated by Terminal app when you start and start typing something, so the terminal data is stored there.

Answer 1

It is encrypted with AES so you will need the keys from windows.plist to decode.

The format is (all stored in big-endian):

offset  value
0-3     magic ('NSCR' for PersistentUIRecord)
4-7     version (either '1000' or '0006')
8-11    NSWindowID (used to lookup 128-bit AES key stored in windows.plist)
12-15   record length (including from 0 to xxx)
16-xxx  encrypted binary plist data

There may be multiple records stored in a file consecutively.

Similar approach AppKit framework is using to decipher the data.data file. The most relevant code base to look at is the +[NSPersistentUIRecord parseOneRecordFromReadBlock:withDecryptionKeys:] block which parses each record in the data.data file.