Recover Notes from TimeMachine

I have deleted an information in a note I need to recover. The note is purely local (not synched in the cloud or on any other device).

I'm using Mac OS X El Capitan V10.11.3 and the Apple app "Notes" Version 4.2 (549.10.1).

I do have several Time Machine backups available.

I did find several solutions on the internet but they seems to apply to older version of the Notes app.

If I open the Time Machine backup and go to:

/Users/<my username>/Library/Containers/com.apple.Notes/Data/Library

• The subfolder "Notes" has an old databases "NotesV6.storedata" but not modified since my upgrade to El Capitan so it's an old version.

Note that this database could contain the info I'm looking for so a solution to my immediate issue may be to find a way to read it...

• The subfolder CoreData/ExternalRecords/NotesV4/6003A0A6.....401 contains many subfolders, among them the ICNote/_records/O/ that seems to contains the notes, but this is all 0 byte size files that, when looked at in finder contains the current version of my notes, so it seems they are some kind of pointer to the notes location rather than a backup of the notes. (In the console they are not symlinks.)

Doing a grep with keyword that are presents in the notes did not help.

So the question is: which files should I restore from Time Machine to recover my notes?

Solution 1:

Empirically, it seems that the 3 items in
~/Library/Group Containers/group.com.apple.notes/
are updated as a Note is changed, whereas those in
~/Library/Containers/com.apple.Notes/Data/Library/Notes/
are only updated periodically [I cannot find how to trigger those to update, I thought making a new Note may do it, but it appears not.]

My research was actually aided by my old faithful - EasyFind (freeware, no affiliation) - which I set hunting for a keyword in one of my existing Notes. It took quite some time, but found it in the end.