Google Messages database (bugle_db) — Forensic Artifact Reference (Android)

01Location

*/com.google.android.apps.messaging/databases/bugle_db (with any -wal, -shm or -journal companion files)

Which texts and attachments were exchanged in Google Messages, with whom, and when?
Which conversation does a given part belong to, and under what name?
Was a part sent from this device or received from another participant, according to the sub_id rule?

Format	SQLite database. ALEAPP reads the tables parts, messages, participants and conversations: parts.message_id = messages._id, messages.sender_id = participants._id and parts.conversation_id = conversations._id. The result has one row per part, that is, per text or attachment, not per message.
Applies to	ALEAPP's test images cover Android 13 to 16 and Google Messages version codes from 161637900 to 311755063. Older bugle_db generations lack parts.file_size_bytes and parts.local_cache_path; ALEAPP reads those columns as NULL when absent.

Field	What it tells you
parts.text	Text of the part.
parts.content_type	Content type of the part; ALEAPP reports it as the message type.
parts.file_size_bytes / parts.local_cache_path	Attachment size and local cache path. A size of -1 is shown by ALEAPP as N/A. These columns are absent in older generations.
participants.display_destination	Sender as ALEAPP reports it in the Message Sender column.
participants.sub_id	ALEAPP derives direction from it: -2 marks a participant other than the device's own, any other value is treated as the self participant, and NULL leaves direction blank.
conversations.name / parts.conversation_id	Conversation name and the identifier that groups parts into a conversation.

Field	Encoding	Note
parts.timestamp	Unix epoch, milliseconds	ALEAPP divides by 1000 and renders the value as UTC.

Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.

Preserve bugle_db together with its -wal, -shm and -journal companion files.
Record the schema first: check whether parts.file_size_bytes and parts.local_cache_path exist before relying on them.
Convert parts.timestamp from milliseconds to UTC and keep the raw value beside it.
Count messages by messages._id, not by the number of rows, because each text or attachment is its own row.
Correlate senders with the contacts and call-log databases and with the telephony provider's SMS/MMS store.

The direction rule comes from the AOSP Messaging source; the Google Messages build is not open source, so report direction as a parser inference.
A row with a NULL sub_id has no direction in ALEAPP's output; do not fill it in.
In WAL mode recent changes may exist only in the -wal file until a checkpoint; reading the main file alone can miss or misstate records.

ALEAPP — scripts/artifacts/googleMessages.py Alexis Brignoni et al. (GitHub) · checked 2026-10-23
SQLite — Write-Ahead Logging SQLite · checked 2026-10-14