{"id":31192242,"url":"https://github.com/anonfaded/notepaddecoder","last_synced_at":"2025-09-19T23:47:11.899Z","repository":{"id":313422053,"uuid":"1051371945","full_name":"anonfaded/NotepadDecoder","owner":"anonfaded","description":"Recover and decode unsaved Windows Notepad binary files into readable notes","archived":false,"fork":false,"pushed_at":"2025-09-05T22:32:15.000Z","size":56,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-09-06T00:20:48.058Z","etag":null,"topics":["decoding","dfir-automation","forensics-tools","windows-notepad"],"latest_commit_sha":null,"homepage":"https://blog.faded.dev/posts/notepad_decoder/","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/anonfaded.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-09-05T21:51:32.000Z","updated_at":"2025-09-05T22:32:19.000Z","dependencies_parsed_at":"2025-09-06T00:20:49.503Z","dependency_job_id":"ffdcdb78-9321-4c14-845a-bce66af3d93f","html_url":"https://github.com/anonfaded/NotepadDecoder","commit_stats":null,"previous_names":["anonfaded/notepaddecoder"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/anonfaded/NotepadDecoder","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anonfaded%2FNotepadDecoder","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anonfaded%2FNotepadDecoder/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anonfaded%2FNotepadDecoder/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anonfaded%2FNotepadDecoder/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/anonfaded","download_url":"https://codeload.github.com/anonfaded/NotepadDecoder/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anonfaded%2FNotepadDecoder/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":276017543,"owners_count":25570946,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-09-19T02:00:09.700Z","response_time":108,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["decoding","dfir-automation","forensics-tools","windows-notepad"],"created_at":"2025-09-19T23:47:10.760Z","updated_at":"2025-09-19T23:47:11.884Z","avatar_url":"https://github.com/anonfaded.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003cdiv align=\"center\"\u003e\n\n  # `\u003e_` NotepadDecoder\n  \u003cimg src=\"img/banner.png\" alt=\"NotepadDecoder Banner\" width=\"800\"\u003e\n  \n  *Recover and decode unsaved Windows Notepad binary files into readable notes.*\n\u003c/div\u003e\n\n## `\u003e_` Detailed Guide\n\nFor a comprehensive step-by-step guide including manual analysis with `strings` and `hexdump`, visit:  \n**[Complete Guide: Decoding Notepad Binary Files](https://blog.faded.dev/posts/notepad_decoder/)**\n\n## `\u003e_` Overview\n\nNotepadDecoder extracts UTF-16LE encoded text from Windows Notepad's TabState binary files. These files contain unsaved Notepad content that would otherwise be lost. Perfect for dual-boot setups, forensics, or data recovery scenarios.\n\n## `\u003e_` Features\n\n- 🔍 **Automatic Detection**: Scans for UTF-16LE text runs in .bin files\n- 📁 **Batch Processing**: Process single files or entire directories\n- 🎨 **Interactive Mode**: User-friendly CLI with file previews\n- 💾 **Smart Output**: Saves decoded content as readable markdown files\n- 🖥️ **Cross-Platform**: Works on Linux, Windows, and macOS\n\n## `\u003e_` Quick Start\n\n### `\u003e_` Prerequisites\n- Python 3.10+ ([Download Python](https://www.python.org/downloads/))\n- For colors: `pip install colorama`\n\n### `\u003e_` Installation\n```bash\ngit clone https://github.com/anonfaded/NotepadDecoder.git\ncd NotepadDecoder\n```\n\n### `\u003e_` Usage\n\n**Single File:**\n```bash\npython3 notepad_decoder.py /path/to/TabState/file.bin\n# or python notepad_decoder.py on Windows\n```\n\n**Directory (Batch Processing):**\n```bash\npython3 notepad_decoder.py /path/to/TabState/\n# or python notepad_decoder.py on Windows\n```\n\n**Interactive Mode:**\n```bash\npython3 notepad_decoder.py\n# or python notepad_decoder.py on Windows\n```\n\n**Help:**\n```bash\npython3 notepad_decoder.py --help\n# or python notepad_decoder.py --help on Windows\n```\n\n## `\u003e_` Example Output\nWhen run on a single `.bin` file, this is the output:\n\n```md\nExtracted Content:\n----------------------------------------\nadded zoom feature\nadded immediate delete option\nsome notes here\nfixed issue with the wide lens and 60fps not working\n```\n\n## `\u003e_` Windows TabState Location\n\nThe TabState files are located at:\n```zsh\nC:\\Users\\USERNAME\\AppData\\Local\\Packages\\Microsoft.WindowsNotepad_8wekyb3d8bbwe\\LocalState\\TabState\\\n```\n\nFor dual-boot Linux users, use `ls -la /media/\u003cUSER\u003e/` to find the mounted drives and navigate to where the TabState files are stored:\n```zsh\n/media/USERNAME/DRIVE/Users/USERNAME/AppData/Local/Packages/Microsoft.WindowsNotepad_8wekyb3d8bbwe/LocalState/TabState/\n```\n\n## `\u003e_` How It Works\n\n1. **UTF-16LE Detection**: Scans binary files for UTF-16LE encoded ASCII sequences\n2. **Fallback Decoding**: Attempts whole-file UTF-16LE decoding at multiple offsets\n3. **Content Extraction**: Extracts readable text and saves as markdown files\n4. **Smart Naming**: Creates meaningful filenames from content\n\n## `\u003e_` License\n\nMIT License - see LICENSE file for details.\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fanonfaded%2Fnotepaddecoder","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fanonfaded%2Fnotepaddecoder","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fanonfaded%2Fnotepaddecoder/lists"}