Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I'm trying to get all my Messages (not E-Mail) and connected attachments out of a iOS 6 backup. I know there are tools like Wondershare Data Recovery for iTunes but they are not cheap and I'm trying to do this by my self with a self written python script.

I already know that the backups are stored here:

~/Library/Application Support/MobileSync/Backup/

And in a specific backup (XY) the messages are stored in this file:

~/Library/Application Support/MobileSync/Backup/XY/3d0d7e5fb2ce288813306e4d4636395e047a3d28

This is a SQlite database file, so I can access it in different ways (e.g. SQLite Manager add-on for Firefox).

Now where are the attachments? In the messages database file above I found a table called "attachment" and "message_attachment_join" which helps to get the right attachments to a single message. But the path in "attachment" is like:


I think this is the path on the iPhone. Where are all this files backuped to? In a backup directory I found three big files about 1.5 to 2.5 GB. Maybe they are stored there? But in which format, as a ZIP or TAR?

Does somebody know where I can find this files?

share|improve this question
found a very helpfull article on iOS backup structure and a free extract tool. But no answer to my question yet :) –  sspross Jan 11 '13 at 10:44
With the tool I mentioned I can extract the filestructure like var/mobile/Library/SMS/Attachments/* so I'm able to get the files now, but still no clue without this extract tool. I asked the owner if he has time to answer this question. –  sspross Jan 11 '13 at 12:08
Thank you for the updates. Don't forget, you could always answer your own question, because either way, the extractor worked for you. It might help future visitors as well. –  bassplayer7 Jan 11 '13 at 13:33
I think that the Record structure descripted in the article is wrong. I built a PHP script like this but it doesn't work. After I used the structure of @galloglass's answer in this thread it worked. –  TheFox Apr 16 '14 at 13:18
After inode there is a unknown3 missing. –  TheFox Apr 16 '14 at 13:28

2 Answers 2

up vote 1 down vote accepted

Given your file:


Replace the var/mobile/ with MediaDomain- so that you end up with this:


Take the SHA1 hash of the above filename and that should be the name of the file in your backup: e6f11db0844899e5f8a04a796c74c234a3dcc5bc

To get the hash for testing, try the following link: http://www.fileformat.info/tool/hash.htm

share|improve this answer

To close this question: With this free extract tool I can extract the filestructure like: var/mobile/Library/SMS/Attachments/*

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.