AttachmentPath Column in the Notes Plugin is built incorrectly

[Abu-Huraira21]

The notes plugin builts the path for a given attachment incorrectly. I'm on macOS 15 Sequoia 15.6.

The path the plugin builds for an attachment is as follows:
~/Library/Group Containers/group.com.apple.notes/Media/[UUID]/Pasted Graphic.png

However actually, the path that results is:
~/Library/Group Containers/group.com.apple.notes/Accounts/[UUID]/Media/[UUID2]/[UUID3]/Pasted Graphic.png

Looking at the code, I've got the NoteStore.sqlite file on my PC.

Steps to Reproduce

• Create a note and paste any image into it.
• A new entry into the table ZICCLOUDSYNCINGOBJECT is created in the NoteStore.sqilte database.
• Run the mac_apt plugin and collect the value from the AttachmentPath column.
• Search the path in finder. File is not found at the finder path.

Observations

• The issue I'm facing was creating a robust query that accurately extracts the three different UUIDs (UUID1, UUID2, UUID3).
• All of these UUIDs are available in the ZICCLOUDSYNCINGOBJECT table.

[ydkhatri]

You are correct. However trying to recreate this, I only get .../Accounts/LocalAccount/Media/[UUID2]/[UUID3]/Pasted Graphic.png. No UUID, instead I get LocalAccount.

[ydkhatri]

I've fixed it for Tahoe (macOS 26) in this commit 688864f, let me know if this fixes it for you.

[Abu-Huraira21]

Sure let me take a look at it and get back to you.