I'm trying to get all my Messages (not E-Mail) and connected attachments out of a iOS 6 backup. I know there are tools like Wondershare Data Recovery for iTunes but they are not cheap and I'm trying to do this by my self with a self written python script.

I already know that the backups are stored here:

~/Library/Application Support/MobileSync/Backup/

And in a specific backup (XY) the messages are stored in this file:

~/Library/Application Support/MobileSync/Backup/XY/3d0d7e5fb2ce288813306e4d4636395e047a3d28

This is a SQlite database file, so I can access it in different ways (e.g. SQLite Manager add-on for Firefox).

Now where are the attachments? In the messages database file above I found a table called "attachment" and "message_attachment_join" which helps to get the right attachments to a single message. But the path in "attachment" is like:


I think this is the path on the iPhone. Where are all this files backuped to? In a backup directory I found three big files about 1.5 to 2.5 GB. Maybe they are stored there? But in which format, as a ZIP or TAR?

Does somebody know where I can find this files?

  • found a very helpfull article on iOS backup structure and a free extract tool. But no answer to my question yet :)
    – sspross
    Commented Jan 11, 2013 at 10:44
  • With the tool I mentioned I can extract the filestructure like var/mobile/Library/SMS/Attachments/* so I'm able to get the files now, but still no clue without this extract tool. I asked the owner if he has time to answer this question.
    – sspross
    Commented Jan 11, 2013 at 12:08
  • Thank you for the updates. Don't forget, you could always answer your own question, because either way, the extractor worked for you. It might help future visitors as well. Commented Jan 11, 2013 at 13:33
  • I think that the Record structure descripted in the article is wrong. I built a PHP script like this but it doesn't work. After I used the structure of @galloglass's answer in this thread it worked.
    – TheFox
    Commented Apr 16, 2014 at 13:18
  • After inode there is a unknown3 missing.
    – TheFox
    Commented Apr 16, 2014 at 13:28

2 Answers 2


Given your file:


Replace the var/mobile/ with MediaDomain- so that you end up with this:


Take the SHA1 hash of the above filename and that should be the name of the file in your backup: e6f11db0844899e5f8a04a796c74c234a3dcc5bc

To get the hash for testing, try the following link: http://www.fileformat.info/tool/hash.htm

  • 1
    Still works for newer paths that start with ~/Library/SMS/... Thanks! Commented Sep 19, 2015 at 18:11

To close this question: With this free extract tool I can extract the filestructure like: var/mobile/Library/SMS/Attachments/*

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .