IOS – Location of Message Attachments in iOS 6 Backup

backupiositunesmacosmessages

I'm trying to get all my Messages (not E-Mail) and connected attachments out of a iOS 6 backup. I know there are tools like Wondershare Data Recovery for iTunes but they are not cheap and I'm trying to do this by my self with a self written python script.

I already know that the backups are stored here:

~/Library/Application Support/MobileSync/Backup/

And in a specific backup (XY) the messages are stored in this file:

~/Library/Application
Support/MobileSync/Backup/XY/3d0d7e5fb2ce288813306e4d4636395e047a3d28

This is a SQlite database file, so I can access it in different ways (e.g. SQLite Manager add-on for Firefox).

Now where are the attachments? In the messages database file above I found a table called "attachment" and "message_attachment_join" which helps to get the right attachments to a single message. But the path in "attachment" is like:

/var/mobile/Library/SMS/Attachments/5D58C5EE-8F51-445C-A3FC-D6X94B6B6932/IMG_1230.png

I think this is the path on the iPhone. Where are all this files backuped to? In a backup directory I found three big files about 1.5 to 2.5 GB. Maybe they are stored there? But in which format, as a ZIP or TAR?

Does somebody know where I can find this files?

Best Answer

Given your file:

/var/mobile/Library/SMS/Attachments/5D58C5EE-8F51-445C-A3FC-D6X94B6B6932/IMG_1230.png

Replace the var/mobile/ with MediaDomain- so that you end up with this:

MediaDomain-Library/SMS/Attachments/5D58C5EE-8F51-445C-A3FC-D6X94B6B6932/IMG_1230.png

Take the SHA1 hash of the above filename and that should be the name of the file in your backup: e6f11db0844899e5f8a04a796c74c234a3dcc5bc

To get the hash for testing, try the following link: http://www.fileformat.info/tool/hash.htm