3

I'm trying to get all my Messages (not E-Mail) and connected attachments out of a iOS 6 backup. I know there are tools like Wondershare Data Recovery for iTunes but they are not cheap and I'm trying to do this by my self with a self written python script.

I already know that the backups are stored here:

~/Library/Application Support/MobileSync/Backup/

And in a specific backup (XY) the messages are stored in this file:

~/Library/Application Support/MobileSync/Backup/XY/3d0d7e5fb2ce288813306e4d4636395e047a3d28

This is a SQlite database file, so I can access it in different ways (e.g. SQLite Manager add-on for Firefox).

Now where are the attachments? In the messages database file above I found a table called "attachment" and "message_attachment_join" which helps to get the right attachments to a single message. But the path in "attachment" is like:

/var/mobile/Library/SMS/Attachments/5D58C5EE-8F51-445C-A3FC-D6X94B6B6932/IMG_1230.png

I think this is the path on the iPhone. Where are all this files backuped to? In a backup directory I found three big files about 1.5 to 2.5 GB. Maybe they are stored there? But in which format, as a ZIP or TAR?

Does somebody know where I can find this files?

5
  • found a very helpfull article on iOS backup structure and a free extract tool. But no answer to my question yet :)
    – sspross
    Jan 11 '13 at 10:44
  • With the tool I mentioned I can extract the filestructure like var/mobile/Library/SMS/Attachments/* so I'm able to get the files now, but still no clue without this extract tool. I asked the owner if he has time to answer this question.
    – sspross
    Jan 11 '13 at 12:08
  • Thank you for the updates. Don't forget, you could always answer your own question, because either way, the extractor worked for you. It might help future visitors as well. Jan 11 '13 at 13:33
  • I think that the Record structure descripted in the article is wrong. I built a PHP script like this but it doesn't work. After I used the structure of @galloglass's answer in this thread it worked.
    – TheFox
    Apr 16 '14 at 13:18
  • After inode there is a unknown3 missing.
    – TheFox
    Apr 16 '14 at 13:28
5

Given your file:

/var/mobile/Library/SMS/Attachments/5D58C5EE-8F51-445C-A3FC-D6X94B6B6932/IMG_1230.png

Replace the var/mobile/ with MediaDomain- so that you end up with this:

MediaDomain-Library/SMS/Attachments/5D58C5EE-8F51-445C-A3FC-D6X94B6B6932/IMG_1230.png

Take the SHA1 hash of the above filename and that should be the name of the file in your backup: e6f11db0844899e5f8a04a796c74c234a3dcc5bc

To get the hash for testing, try the following link: http://www.fileformat.info/tool/hash.htm

1
  • 1
    Still works for newer paths that start with ~/Library/SMS/... Thanks! Sep 19 '15 at 18:11
0

To close this question: With this free extract tool I can extract the filestructure like: var/mobile/Library/SMS/Attachments/*

This site is temporarily in read only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .