iOS Messages
Investigation
Overview
• Introduction to Messages App
• Investigating Messaging Database
Introduction to iOS
Messaging
SMS/MMS
Why it's important to investigate
Messages
• Messages are one of the most popular forms of communication
• People use Messaging apps to share information
• Messages may give the information about
• Who sent it
• Who received it
• Timestamps
• Message content
What is a messaging service?
• SMS (short message service)
• a text messaging service
component of most telephone,
Internet, and mobile device
systems
• MMS (Multimedia Message
Service)
• send multimedia content—
pictures, video, and audio—in
addition to text
How Messages are sent/received
Message is routed through
Cell Tower Network
Sending Device Receiving Device
What is iMessage?
• Messages is the default texting app for
iOS on any iPhone, iPod touch, and
iPad. It lets you do all the basic things
you'd expect: Send texts, photos, emojis,
and all the other standard texting stuff.
• On the other hand, iMessage is an Apple-
specific set of features and tools that are
built on top of Messages. The advanced
features used in Messages come from
iMessage. You can use other apps to send
texts from your iPhone, but if you want to
use all of iMessage's features, your only
option is to use the Messages app.
What is iMessage? (2)
• The iMessage service works on all devices that run
iOS 5 and higher, including the iPod touch and iPad.
It's also built into the Messages app that comes with
all Macs running Mac OS X 10.7 and later.
• The Messages app lets you text anyone whose device
can receive standard text messages, including people
using Android and other phones. If those people
don't have iMessage, though, they won't be able to
use any of iMessage's features. Any iMessage-
specific things you send, like animations, won't work
on their devices.
Differences between iMessage and
SMS
iMessage SMS
1. Your word balloons are blue. 1. Green word balloons.
2. The Send button is blue. 2. A green Send button.
3. The text-entry box reads iMessage before you've typed 3. The text-entry box reads Text
in it. Message before you've typed in it.
4. Depending on the recipient's read-receipt settings, some
iMessage's will also say Delivered beneath them.
Investigating Messages
Database
SMS/MMS
How iOS stores Messages from
Messages App
• iOS stores Messages in an SQLite database file located here ~/private/var/mobile/Library/SMS/[Link]
Attachments as well as Drafts (typed out but unsent) messages also are stored here.
Database Structure
• sqlite_sequence
• _SqliteDatabaseProperties
• msg_group
• group_member
• message
• msg_pieces
• madrid_attachment
• madrid_chat
Important Tables
message This is the main table where all messages are stored.
msg_group This defines a chat (SMS/text/message) conversation
group.
group_member This defines the member of the chat
(SMS/text/message) conversation group. As you
currently cannot define groups, there is always only
one member in each group, so the group_id and
ROWID values match.
msg_pieces This table contains information about MMS objects.
Viewing [Link]
Right click on [Link] and open with DB Browser for SQLite
Viewing [Link] (2)
• Once in the SQLite Browser, we can see all the data tables. To view a table right click on it and select “View Table”
Viewing [Link] (3)
• Select the
attachment table,
right click and
select browse table.
• The attachment
table shows a list of
all attachments
sent via the native
Messages app.
Attachment Table
Created Date, in Apple Cocoa Core Date. File name + Path stored on phone.
978307200=Core Date 2001/01/01 – epoch date 1970/01/01
Attachment Table (2)
Was sent by user = 1
Was received by user = 0
Was deleted = 1
Image extension type Attachment Name File size (in bytes) Not deleted = 0
Chat Table
• Move back to Database Structure tab by
clicking on the Database Structure tab.
• Select and right click Browse table on the
chat table.
• The chat table shows conversation by
threads.
• Conversation threading is how
messages are organized on iOS.
• This method of sorting allows for all
messages exchanged by a sender
and receiver to be stored in 1 place.
Chat Table (2) Chat name (Usually Recipient
shows contact Service type SMS or
Sender Phone # or email name if saved) iMessage
Message Table
• Move back to Database Structure tab
by clicking on the Database Structure
tab.
• Select and right click Browse table on
the message table.
Message Table (2)
Receiving
timestamp
Sender ID, reference chat Apple Core
Message content table ROW ID column Receiving account Cocoa Date