01Location
- /private/var/mobile/Library/SMS/sms.db (+ -wal, -shm)
- /private/var/mobile/Library/SMS/Attachments/
- Backup: HomeDomain-Library/SMS/sms.db
02Questions it answers
- Who exchanged messages with the device, over which service (iMessage or SMS), and when?
- When was a message delivered and read?
- Which local line or account sent or received it on a dual-SIM device?
- Which attachments were exchanged and where are they stored?
03Format and versions
| Format | SQLite database. Messages in message; participants in handle; conversations in chat, linked through chat_message_join and chat_handle_join; attachments in attachment via message_attachment_join. Body text is in message.text or, when empty, in message.attributedBody (a typedstream-serialised NSAttributedString). |
|---|---|
| Applies to | Column sets change across iOS releases; iLEAPP's parser handles both second- and nanosecond-precision date values. |
04Key fields
| Field | What it tells you |
|---|---|
| message.is_from_me | 1 for outgoing, 0 for incoming. |
| message.handle_id → handle.id | Sender handle for received rows (phone number or email). |
| message.service / account | Service name and local account as stored. |
| message.destination_caller_id | Number or identity of the local account used; separates lines on dual-SIM devices; may be an email or UUID. |
| chat.chat_identifier / display_name | Conversation identifier and group name as stored. |
| attachment.filename / transfer_name / mime_type / total_bytes | Stored path, original name, type and size of each attachment. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| message.date | Apple Cocoa time (since 2001-01-01 UTC); seconds or nanoseconds | Add 978,307,200 s to reach Unix time; iLEAPP treats values above 10^15 as nanoseconds. |
| message.date_read / date_delivered | Apple Cocoa time; seconds or nanoseconds | Zero means no value recorded. |
| attachment.created_date | Apple Cocoa time | Attachment record creation time. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Preserve sms.db with -wal/-shm and the Attachments folder.
- Decide the precision of each date column (seconds vs nanoseconds) before converting from the 2001 epoch.
- Decode attributedBody where text is empty.
- Group by chat and list participants through chat_handle_join.
- Normalise destination_caller_id spellings before comparing lines.
07Interpretation pitfalls
- Joins to attachments repeat a message once per attachment; count by message ROWID.
- The same line can appear as bare digits, +E.164 or with a tel: prefix.
- Unflushed changes may exist only in the WAL file.
09Sources
- iLEAPP — scripts/artifacts/sms.py Alexis Brignoni et al. (GitHub) · checked 2026-10-14
- CFAbsoluteTime Apple Developer Documentation · checked 2026-10-14
- SQLite — Write-Ahead Logging SQLite · checked 2026-10-14
- iTunes Backup The Apple Wiki · checked 2026-10-14