iMessage was introduced to iOS devices in iOS 5. Both SMS and iMessages are stored in the same SMS.db file. SMS messages on iOS devices are stored as standard SMS, MMS, or iMessages. While the database has remained the same, iOS 11 introduced changes to the timestamp format and added columns to the sms.db that some tools may not support. More on this will be covered in a few slides.

Prior to iOS 5 and the introduction of the iMessage, all dates and times for messages were stored in UNIX Epoch formats. iOS 5 and the iMessage introduced Mac Epoch timestamp formats. The names associated with the message and most iOS data are stored in plain ASCII, as are the phone numbers and message content. The database fields containing the phone number or email address for the SMS or iMessage may vary and are defined below.

  •  Address or Chat_identifier: SMS Message

  •  Recipient: MMS Message

  •  Madrid_handle: iMessage (introduced with iOS 5)

Files of Interest for SMS

/Library/SMS/sms.db 
/Library/SMS/Attachments/* 
/Library/SMS/Drafts/* 
/Library/Preferences/com.apple.MobileSMS.plist