SMS/MMS messages are stored in the USERDATA/data/com.android.providers.telephony/databases/mmssms.db. There are multiple tables of interest, and they seem to keep changing as the versions of Android are released. For Android 11 and 12 mmssms.db exists in two locations: 

USERDATA/data/com.android.providers.telephony/ and USERDATA/user_de/%USER_NUMBER%/com.android.providers.telephony/ 

  •  The latter contains the ”app_parts” folder 

We recommend searching for “com.android.providers.telephony” or “mmsms.db” to ensure all messages are located for examination and verification. The primary table of interest in this database for SMS is the SMS table. The SMS table contains the following fields, which should be examined for relevance to the investigation:

Address: Phone number or email address

Person: Associated entry in address book (common to be blank)

Date: UNIX Epoch date-time stamp

Read: 1 = message read

           0 = message unread

Type: *Note the "Type" flags may vary on different Android devices and must be verified prior to reporting

          1 = Inbox

          2 = Sent

          3 = Drafts

          5 = Outbox

          6 = Unknown

Body: Message content

service_center: SMSC (service center number) for received messages

For MMS messages, the part table should be examined for the following information:

_data: Location of attachment in file system

Text: Message content if available

Ct: Content type (for example, jpeg or text)

Cl: Content location, often filename

CID: Content-ID, often filename and the same as the CI

The query below will help:

SELECT 

datetime(sms.date/1000,’unixepoch’) AS “Timestamp (UTC), 

sms.address AS “Other Party”, 

CASE 

when sms.type=1 THEN “Incoming” 

when sms.type=2 THEN “Outgoing” 

END AS “Message Direction”, 

CASE 

when sms.read=0 THEN “No” 

when sms.read=1 THEN “Yes” 

END AS “Was Read”, 

sms.body AS “Message” 

FROM 

sms 

MMS: 

SELECT 

datetime(pdu.date/1000,’unixepoch’) AS “Timestamp (UTC)”, 

address.address AS “Other Party”, 

part.ct as “Attachment Type”, 

part._data AS “Attachment Name & Location”, 

part.text AS “Text” 

FROM 

part 

INNER JOIN pdu on pdu._id=part.mid 

INNER JOIN address ON address.msg=part.mid