Where macOS keeps Contacts, Calendar, Reminders, Safari tabs and Voice Memos, and how to read them from a backup

If you've ever needed one deleted contact or a lost Safari tab group back, you've probably found the advice is "restore the whole thing". Mostly that's because nobody writes down where the data lives. So here's the map, checked on macOS 26.6 in a VM with a real Time Machine backup, and on two public encrypted iPhone backups (iOS 15.3.1 and 17.3).

On the Mac

All of these need Full Disk Access to read. Without it, every read fails with "Operation not permitted", and so does tmutil listbackups.

In a Finder iPhone backup

Backups store files under hashed names. Manifest.db maps them, so you look up by domain and relative path:

Time Machine on macOS 26 has a trap

On an APFS destination the real backup is a volume snapshot called com.apple.TimeMachine.<date>.backup. The visible <date>.previous folder is a view of the latest backup. It looks like an incomplete backup, and it isn't one.

To get at the snapshots, run tmutil listbackups. That mounts them read only under /Volumes/.timemachine/<UUID>/, and the mount only appears after you've run it.

The good news is that the default exclusions are system paths and ~/Library/Caches, so every store above was in the snapshot, including the -wal and -shm files.

Things that will bite you if you read these yourself

Copy first, and copy the WAL. These are WAL-mode SQLite databases, and recent changes may only exist in the -wal file. Copy the database with its -wal and -shm to a private folder and open that copy. Real iPhone backups do this too: Manifest.db itself can be in WAL mode, which broke my first reader.

Dates are Cocoa seconds, counted from 1 January 2001, not Unix time.

All-day events end on the last second. In Calendar.sqlitedb a one-day event has end_date at start + 86399. iCalendar's DTEND is the day after, so a straight copy gives you the wrong end date.

Reminders lists are confusing. A list's name is in ZREMCDOBJECT.ZNAME2, while ZNAME is the account. iOS 17 and macOS 26 keep reminders in ZREMCDREMINDER, and iOS 15 keeps them all in ZREMCDOBJECT.

Safari's Frequently Visited folder isn't bookmarks. com.apple.FrequentlyVisitedSites sits in the same table, hidden. Filter it out, or your restore fills up with sites nobody saved.

Write vCard 3.0. Apple's CNContactVCardSerialization read 3.0 UTF-8 correctly in my tests, but garbled non-ASCII text in a 4.0 card ("Åse" became "√Öse"). It also cuts a URL at an unescaped semicolon.

Voice Memos can have rows with no audio. ZEVICTIONDATE means the audio was moved to iCloud, so the file isn't local. A row with no .m4a isn't corruption.

Getting things back in

• Contacts: a .vcf opens in Contacts, which asks you to confirm before adding anything. Safe to try.
• Calendar: same with .ics, with a confirmation dialog first.
• Safari bookmarks: File > Import From > Bookmarks HTML File.
• Safari tab groups: I found no safe way to write them back, so export them as a bookmarks folder and a URL list.
• Voice Memos: open -a VoiceMemos file.m4a imports a file.
• Reminders: I didn't find a reliable import, so treat this as export only.

What I didn't verify

To be straight about the gaps: the public iPhone images had no voice memos and no reminder items, so those paths are less proven. They also had no named Safari tab groups. My test Mac was a fresh install in a VM, so Bookmarks.plist didn't exist yet and that path comes from Apple's docs, and I didn't click through the Safari bookmarks import. Check your own files before trusting this for those.

Full disclosure: I sell a Mac app built on this research, NoteRescue. It does the comparison per item across backups, and the scan is free. You don't need it if you're comfortable with sqlite3 and the paths above.

Written with AI assistance. The paths come from my own test notes.