Home

Welcome to the iPhone SMS Backup wiki!

This wiki is a collection of notes on reverse-engineering the iPhone SMS/Messages database. Previously, some of this information was included the README, but it has gotten too long for that!

Where is the SMS/Messages Database Located

The backup sqlite db file in OS X is located

~/Library/Application Support/MobileSync/Backup/<phone ID>/

The backup sqlite db file in Windows Vista/7/8/8.1 is located

C:\Users\<user name>\AppData\Roaming\Apple Computer\MobileSync\Backup\<phone ID>\

and is named 3d0d7e5fb2ce288813306e4d4636395e047a3d28.

It's name is an SHA1 hash of the full path of the file on the phone, plus its Domain.

$ printf 'HomeDomain-Library/SMS/sms.db' | openssl sha1
3d0d7e5fb2ce288813306e4d4636395e047a3d28

Understanding the SMS/Messages Database

• iPhone Messages Database Schema

• Meaning-of-FLAGS-Fields

Helpful Links

• http://www.slideshare.net/hrgeeks/iphone-forensics-without-the-iphone
• http://damon.durandfamily.org/archives/000487.html
• http://linuxsleuthing.blogspot.com/2011/02/parsing-iphone-sms-database.html
• http://www.scip.ch/?labs.20111103
• http://d.hatena.ne.jp/sak_65536/20111017/1318829688

(The last two links are good for iOS5 schema discussions. Google Translate was a big help here!)