- Nationwide Digital Forensic & Cyber Services
- BOOK A FREE CONSULTATION TODAY!
Independent forensic examination of the iOS Messages database — SMS, MMS, iMessage, RCS, group threads, attachments, reactions, replies, and Recently Deleted — with deleted-message recovery from SQLite WAL and unallocated pages.
Quick Answer. iPhone message forensics parses the iOS sms.db SQLite database at /private/var/mobile/Library/SMS/sms.db together with its WAL and SHM sidecars. Message rows live in the message table, threads in chat, participants in handle, attachments in attachment. Deleted messages routinely persist in the WAL journal, in freelist pages, and in iCloud/local backups predating the deletion. iOS 16+ also retains deletions in a Recently Deleted folder for up to 30 days.
| Table | Contents | Forensic value |
|---|---|---|
| message | Each message row: ROWID, guid, text, handle_id, service (SMS/iMessage/RCS), date, date_read, date_delivered, is_from_me, associated_message_guid | Message body, sender/receiver, direction, timestamps, reactions and replies |
| chat | chat_identifier, service_name, display_name, room_name, group participants | Thread reconstruction and group membership over time |
| handle | Phone number, email or Apple ID per participant | Identifies who is who across services |
| attachment | filename, mime_type, transfer_state, uti, created_date | Photo/video/audio/file attachments — paths under /Library/SMS/Attachments/ |
| chat_message_join / chat_handle_join | Many-to-many mappings | Rebuild thread state at any point in time |
| message_summary_info | Edit/undo history blobs (iOS 16+) | Prior versions of edited messages |
Deleted iMessages and SMS routinely remain accessible via several parallel paths, in this order of yield:
message.is_deleted = 1.sms.db-wal captures every uncheckpointed transaction; deleted rows commonly still resolve.sms.db recovers page fragments containing message text and metadata after WAL checkpoint.Manifest.db maps to 3d0d7e5fb2ce288813306e4d4636395e047a3d28.Notifications plist and KnowledgeC ZOBJECT / /app/inFocus streams often preserve message previews.Since iOS 16 users can edit a message for 15 minutes and un-send within 2 minutes. Every edit is stored: message_summary_info contains a bplist with ec (edit content) arrays and timestamps for each revision. Un-sent messages are flagged is_deleted = 1 but retain the original text field. Tapback reactions (“liked”, “loved”, etc.) are stored as separate rows with associated_message_type in the 2000–3005 range and associated_message_guid pointing at the parent.
Attachments are stored on disk under /private/var/mobile/Library/SMS/Attachments/ in a two-level hash directory. EXIF and creation/modification metadata are preserved for images and videos; we hash every attachment and correlate it with the parent message row. For URL previews, the attachment.payload_data plist contains the URL, page title and preview image cached at message time — often decisive when the destination page has since changed.
iOS message timestamps are stored in Apple Core Data time (nanoseconds since 2001-01-01 UTC on iOS 11+, seconds prior). We normalize every timestamp to UTC and to the device’s local time zone at the moment of the event using com.apple.preferences.datetime.plist and Unified Log time zone changes, so testimony withstands cross-examination about “when” a message actually sent.
Elite Digital Forensics is an independent, defense-aligned iPhone forensics practice. We are retained by attorneys, in-house counsel, and, where appropriate, individuals and businesses directly. Every engagement begins with a scoped acquisition plan, hash-verified evidence, and a written report suitable for attorney review, negotiation, or court. When retained through counsel, our work product is protected. See the iPhone Forensics hub for the full analytical framework we bring to every matter.
Frequently. Un-sent messages set is_deleted=1 but retain the original text field for a period; the WAL and prior backups almost always contain the original content. iOS 16.1+ also stores edit history in message_summary_info.
Those live in each app’s container — WhatsApp in ChatStorage.sqlite, Signal in an encrypted SQLCipher database. Recovery is possible with the passcode or a full logical extraction; see the iPhone Application Forensics page.
On the device itself, no. But iCloud Messages, prior iTunes/Finder backups on a paired computer, and any lockdown-record-based logical images taken before the reset all retain the content.
By cross-corroborating message.is_from_me with KnowledgeC /app/inFocus events for MobileSMS at the exact minute, cellular/Wi-Fi state, unlock events, and CoreDuet suggestion outputs. Multiple independent artifacts create a defensible narrative.
Tell us about the Mac, the accounts, and the timeframe. We will tell you what is recoverable, what is not, and what it will cost.
Request Confidential Consultation Call (833) 292-3733This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic services and expert witness testimony; we do not provide legal representation. Every case is fact-specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder