I'm trying to get all my Messages (not E-Mail) and connected attachments out of a iOS 6 backup. I know there are tools like Wondershare Data Recovery for iTunes but they are not cheap and I'm trying to do this by my self with a self written python script.

I already know that the backups are stored here:

~/Library/Application Support/MobileSync/Backup/

And in a specific backup (XY) the messages are stored in this file:

~/Library/Application Support/MobileSync/Backup/XY/3d0d7e5fb2ce288813306e4d4636395e047a3d28

This is a SQlite database file, so I can access it in different ways (e.g. SQLite Manager add-on for Firefox).

Now where are the attachments? In the messages database file above I found a table called "attachment" and "message_attachment_join" which helps to get the right attachments to a single message. But the path in "attachment" is like:


I think this is the path on the iPhone. Where are all this files backuped to? In a backup directory I found three big files about 1.5 to 2.5 GB. Maybe they are stored there? But in which format, as a ZIP or TAR?

Does somebody know where I can find this files?

  • found a very helpfull article on iOS backup structure and a free extract tool. But no answer to my question yet :) – sspross Jan 11 '13 at 10:44
  • With the tool I mentioned I can extract the filestructure like var/mobile/Library/SMS/Attachments/* so I'm able to get the files now, but still no clue without this extract tool. I asked the owner if he has time to answer this question. – sspross Jan 11 '13 at 12:08
  • Thank you for the updates. Don't forget, you could always answer your own question, because either way, the extractor worked for you. It might help future visitors as well. – bassplayer7 Jan 11 '13 at 13:33
  • I think that the Record structure descripted in the article is wrong. I built a PHP script like this but it doesn't work. After I used the structure of @galloglass's answer in this thread it worked. – TheFox Apr 16 '14 at 13:18
  • After inode there is a unknown3 missing. – TheFox Apr 16 '14 at 13:28

Given your file:


Replace the var/mobile/ with MediaDomain- so that you end up with this:


Take the SHA1 hash of the above filename and that should be the name of the file in your backup: e6f11db0844899e5f8a04a796c74c234a3dcc5bc

To get the hash for testing, try the following link: http://www.fileformat.info/tool/hash.htm

  • Still works for newer paths that start with ~/Library/SMS/... Thanks! – Nate Barbettini Sep 19 '15 at 18:11

To close this question: With this free extract tool I can extract the filestructure like: var/mobile/Library/SMS/Attachments/*

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .