I’m not sure when, but most likely when Leopard was released, applications started storing their cache files as sqlite databases (usually named Cache.db). For example, Safari has its cache at:
Apps that haven’t caught up yet are still using the less-efficient .cache files. Though not as efficient, these files are easier to access, just toss it onto BBEdit and you can see the contents. Try doing this with a 100+MB .db file and prepare to wait.
There probably is a GUI app to extract data from .db cache files, but I’m too lazy for that. OS X has everything you need already built in so fire up Terminal.app (I’ve been playing with Visor lately) and dig into your cache:
# cd ~/Library/Caches/com.apple.Safari/ # sqlite3 Cache.db
You’ll be in the sqlite interactive mode:
sqlite> select * from cfurl_cache_response; sqlite> select receiver_data from cfurl_cache_blob_data where entry_ID = ;
To output the data to a file use the following:
sqlite> .output test.html sqlite> select receiver_data from cfurl_cache_blob_data where entry_ID = ; sqlite> .exit
That should do it. Any questions? Leave a comment.
4 thoughts on “Pulling Content Out Of OS X Cache.db Files”
it didn't works….
i delete the [ character but and it works better but I don't have the data in the output file ??!!
Could you help me ??
What OS X version are you running? Also, you should try a different query just to get SOME kind of output. Maybe "select receiver_data from cfurl_cache_blob_data;" (leaving out the WHERE altogether). Does this get you any closer?
say that I can see the BLOB in a record – how do you know if its an html, image or what?
You'll probably have to save it as a text file and check the first couple lines for clues as to what type of file it is. Usually there is embedded meta-data such as PNG/PDF/JPG etc. Sorry, I can't be more specific.