parse_notificationdb_records.sh

#!/bin/bash

# Check if the database path is provided as an argument
if [ -z "$1" ]; then
    echo "Usage: $0 /path/to/your/database.sqlite"
    exit 1
fi

# Use the first argument as the database file path
DB_PATH="$1"

# Query to select the data column as hex from the record table
SQL_QUERY="SELECT hex(data) FROM record;"

# Execute the query and process each row
sqlite3 "$DB_PATH" "$SQL_QUERY" | while read -r HEXDATA; do
    # Convert hex to binary and then to plist format
    echo "$HEXDATA" | xxd -r -p - | plutil -p -
done

/Users/$USER/Library/Group\ Containers/group.com.apple.usernoted/db2 doesn't seem to be user-accessible anymore even with root. Are there known workarounds ?

That is because of macOS's new TCC protection of containers. You can give Full Disk Access permission to your app or allow it through a popup. Not much more you can do.

bash parse_notificationdb_records.sh /Users/$USER/Library/Group\ Containers/group.com.apple.usernoted/db2/db

macos 15上运行成功，需要开启“完全磁盘访问”权限