How to read and manipulate ~/Library/Saved Application State/com.apple.finder.savedState/data.data
These savedState resources are used by macOS to support "resuming" applications:


  One of the new features in OS X Lion and OS X Mountain Lion is the “Resume” ability for all applications to save their last state, meaning when you relaunch the app or reboot your Mac, the application will “resume” and reopen again showing all of the windows and data that was last in use.


http://osxdaily.com/2011/07/17/delete-specific-application-saved-states-from-mac-os-x-10-7-lion-resume/

I've used these savedState resources to recover command line activity of hackers while responding to computer security incidents.



Within a savedState directory, there are at least two files:


windows.plist, and
data.data


windows.plist contains window layout information and other metadata. data.data is a file containing encrypted records whose plaintext includes a serialized NSKeyedArchiver blob with application-specific state. You can use the fields NSDataKey from windows.plist as AES keys to decrypt records in data.data using CBC mode with IV | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |.

The layout of an (encrypted) record within data.data is:

typedef struct SavedStateRecord {
    char     magic[4];          // "NSCR"
    char     version[4];        // "1000"
    uint32_t window_id;         // little endian
    uint32_t cipher_text_size;  // little endian
    uint8_t  cipher_text[cipher_text_size];
} SavedStateRecord;


Once the record is decrypted, the layout looks something like:

// little endian
typedef struct SavedStateRecordPlaintext {
    uint32_t unk1;             // often 0x0
    uint32_t class_name_size;
    char     class_name[class_name_size];
    char     magic[4];         // "rchv"
    uint32_t size;

    // This is an NSKeyedArchiver serialized data structure.
    // In practice, a bplist with specific interpretation.
    uint8_t  buf[size];
} SavedStateRecordPlaintext;


From there, you can extract the bplist from the NSKeyedArchiver structure and manipulate it. The interpretation of the bplist state is application-specific.

I've written a parser to support computer forensics that is available here: https://gist.github.com/williballenthin/994db929b1448fdf73baf91207129dec

CrowdStrike also has a parser and resources that are describe here: https://www.crowdstrike.com/blog/reconstructing-command-line-activity-on-macos/