Context

Rewind stopped being usable long before it stopped being maintained.

Rewind.ai can safely be classified as abandonware at this point. That’s problem two.

Problem one: My 16” MacBook Pro M4 Max lasts 3 hours on battery with Rewind running. Three hours. On a machine that should do 12+ for normal workloads. That’s insane.

The culprit is obvious once you think about what Rewind actually does:

• Constant screenshots — capturing your screen every two seconds
• PNG → MP4 conversion — encoding near-identical frames into video to save space, which is CPU intensive
• OCR on every frame — text extraction is not free
• Encrypted SQLite writes — AES-256 with HMAC on every insert - this is pretty cheap as AES-256 is a very fast algorithm and dealt with in hardware on most ARM chips
• Audio capture — always listening for meetings
• Whisper transcription — on-device ASR burning cycles

All of this, all the time, whether you’re plugged in or running on battery at a coffee shop. No power awareness. No throttling. Just constant drain.

So I wrote my own capture tool. Simple: Just screenshots and audio if enabled, and only do ocr/indexing/mp4 conversion when the machine is plugged in. I still want the memory. I just don’t want it to kill my battery. Plus, now I can add my own features and not be stuck on basic calls to gpt4 !! (not 4o) - this is the abandonware cost.

Why I Needed the Raw SQLite

I have 54 GB of existing Rewind data I wanted to migrate and about 400GB of video and audio. I don’t need a “marketing” export. The raw SQLite is what I need so I can move it into my pipeline, run my own retrieval, and decide what gets kept.

Rewind records screen + audio, tosses everything into a local database, and calls it “your memory”. But you cannot retrieve your own data from it unless you pay them 200+/year and you can only use that in their app. Zero portability. Anyway, the sqlite file looked like noise. The keychain item looked like it existed but didn’t. That combo is exactly where reverse engineering stops being a hobby and becomes engineering.

This is a playbook of what I did, what worked, and the two separate encryption stacks Rewind uses. Also, upfront note: Ghidra is overkill for this. You can do it all with standard tools: lldb, node and standard macos commands.

If you’ve ever had to recover data from a hostile app, this will feel familiar.