2

I'm trying to get all my Messages (not E-Mail) and connected attachments out of a iOS 6 backup. I know there are tools like Wondershare Data Recovery for iTunes but they are not cheap and I'm trying to do this by my self with a self written python script.

I already know that the backups are stored here:

~/Library/Application Support/MobileSync/Backup/

And in a specific backup (XY) the messages are stored in this file:

~/Library/Application Support/MobileSync/Backup/XY/3d0d7e5fb2ce288813306e4d4636395e047a3d28

This is a SQlite database file, so I can access it in different ways (e.g. SQLite Manager add-on for Firefox).

Now where are the attachments? In the messages database file above I found a table called "attachment" and "message_attachment_join" which helps to get the right attachments to a single message. But the path in "attachment" is like:

/var/mobile/Library/SMS/Attachments/5D58C5EE-8F51-445C-A3FC-D6X94B6B6932/IMG_1230.png

I think this is the path on the iPhone. Where are all this files backuped to? In a backup directory I found three big files about 1.5 to 2.5 GB. Maybe they are stored there? But in which format, as a ZIP or TAR?

Does somebody know where I can find this files?

Improve this question
5
  • found a very helpfull article on iOS backup structure and a free extract tool. But no answer to my question yet :)
    – sspross
    Jan 11, 2013 at 10:44
  • With the tool I mentioned I can extract the filestructure like var/mobile/Library/SMS/Attachments/* so I'm able to get the files now, but still no clue without this extract tool. I asked the owner if he has time to answer this question.
    – sspross
    Jan 11, 2013 at 12:08
  • Thank you for the updates. Don't forget, you could always answer your own question, because either way, the extractor worked for you. It might help future visitors as well.
    – bassplayer7
    Jan 11, 2013 at 13:33
  • I think that the Record structure descripted in the article is wrong. I built a PHP script like this but it doesn't work. After I used the structure of @galloglass's answer in this thread it worked.
    – TheFox
    Apr 16, 2014 at 13:18
  • After inode there is a unknown3 missing.
    – TheFox
    Apr 16, 2014 at 13:28

2 Answers 2

Reset to default
5

Given your file:

/var/mobile/Library/SMS/Attachments/5D58C5EE-8F51-445C-A3FC-D6X94B6B6932/IMG_1230.png

Replace the var/mobile/ with MediaDomain- so that you end up with this:

MediaDomain-Library/SMS/Attachments/5D58C5EE-8F51-445C-A3FC-D6X94B6B6932/IMG_1230.png

Take the SHA1 hash of the above filename and that should be the name of the file in your backup: e6f11db0844899e5f8a04a796c74c234a3dcc5bc

To get the hash for testing, try the following link: http://www.fileformat.info/tool/hash.htm

Improve this answer
1
  • 1
    Still works for newer paths that start with ~/Library/SMS/... Thanks!
    – Nate Barbettini
    Sep 19, 2015 at 18:11
0

To close this question: With this free extract tool I can extract the filestructure like: var/mobile/Library/SMS/Attachments/*

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .