AndroidCoreMessaging

SMS/MMS database (mmssms.db)

Android Telephony provider store for SMS and MMS: addresses, bodies, box/type codes, read flags, threads and MMS part files.

01Location

  • /data/data/com.android.providers.telephony/databases/mmssms.db
  • /data/user/<userId>/com.android.providers.telephony/databases/mmssms.db
  • /data/data/com.android.providers.telephony/app_parts/ (MMS part files; some layouts use …/parts/)

02Questions it answers

  • Which numbers or addresses exchanged SMS/MMS with the device, and when?
  • Was a message received, sent, drafted, queued or failed?
  • Had the message been read or seen on the device?
  • Which attachments belonged to an MMS, and are the part files still present?

03Format and versions

FormatSQLite database created by the AOSP TelephonyProvider (MmsSmsDatabaseHelper, DATABASE_NAME "mmssms.db"). SMS rows live in the sms table; MMS headers in pdu, addresses in addr and body parts in part, with part._data pointing to a file on disk. Threads are tracked in threads and canonical_addresses.
Applies toAOSP Telephony provider; the public column constants are documented from API level 19. Vendor builds add variants: ALEAPP handles a Samsung spam_sms table and LG extended sms.type values whose labels are not vendor-documented.

04Key fields

FieldWhat it tells you
sms.addressThe address of the other party (TEXT).
sms.typeMessage box: 1 inbox, 2 sent, 3 draft, 4 outbox, 5 failed, 6 queued (0 = all).
sms.read / sms.seenread: has the message been read; seen: whether the user has seen it, which drives notification display.
sms.thread_idConversation (thread) the message belongs to; shared with MMS rows.
sms.statusTP-Status for sent messages: -1 none, 0 complete, 32 pending, 64 failed.
pdu.msg_boxMMS box: 1 inbox, 2 sent, 3 drafts, 4 outbox, 5 failed (0 = all).
addr.typeMMS address role used by ALEAPP: 0x89 From, 0x97 To, 0x82 Cc, 0x81 Bcc; joined on addr.msg_id = pdu._id.
part.ct / part._dataContent type of each MMS part and the recorded path of its file.

05Timestamps

FieldEncodingNote
sms.dateUnix epoch, millisecondsDocumented as the date the message was received.
sms.date_sentUnix epoch, millisecondsDocumented as the date the message was sent; compare with date before building a sequence.
pdu.date / pdu.date_sentUnix epoch, secondsMMS dates are in seconds; the provider's own union query multiplies pdu.date by 1000 to align it with SMS.

Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.

06Examination workflow

  1. Preserve mmssms.db together with any -wal/-journal companion files and the app_parts (or parts) folder.
  2. Record the schema: check for vendor tables (e.g. spam_sms) and columns before applying type labels.
  3. Normalise SMS milliseconds and MMS seconds to UTC, then merge both transports on thread_id.
  4. Resolve MMS senders and recipients through addr, and match part._data to files by full recorded path, not file name alone.
  5. Correlate addresses with the contacts and call-log databases.

07Interpretation pitfalls

  • LG extended type values 7, 8 and 19 have no vendor documentation; report unknown codes as stored.
  • In WAL mode recent changes may exist only in the -wal file until a checkpoint; reading the main file alone can miss or misstate records.
  • SQLite leaves deleted content in the file unless secure_delete is on or VACUUM runs; recovered fragments must be validated against the schema.
  • An MMS with several parts produces several rows when joined to part; count messages by pdu._id.

09Sources

  1. Telephony.TextBasedSmsColumns — API reference Android Developers · checked 2026-10-14
  2. Telephony.BaseMmsColumns — API reference Android Developers · checked 2026-10-14
  3. AOSP — MmsSmsDatabaseHelper.java Android Open Source Project (GitHub mirror) · checked 2026-10-14
  4. AOSP — MmsSmsProvider.java Android Open Source Project (GitHub mirror) · checked 2026-10-14
  5. ALEAPP — scripts/artifacts/smsmms.py Alexis Brignoni et al. (GitHub) · checked 2026-10-14
  6. SQLite — Write-Ahead Logging SQLite · checked 2026-10-14
  7. SQLite — PRAGMA statements (secure_delete) SQLite · checked 2026-10-14