← All artifacts

Messages

Apple Messages database containing iMessage, SMS, MMS, and RCS conversations, attachment metadata, reactions, and references to recently deleted messages.

Status
available
CLI plugin
messages.apple
Categories
communication, user

Overview

The Messages database is one of the most forensically valuable artifacts on macOS, containing all iMessage, SMS, MMS, and RCS conversations. The collector parses message content (including the attributedBody format used since macOS Ventura), attachment metadata, reactions, group chat metadata, and references to recently deleted messages.

Analysis Tips

  • attributedBody parsing: From macOS 13 Ventura, the text column may be NULL; message content is stored in attributedBody as an NSKeyedArchiver binary blob
  • Deleted messages: The deleted_messages table tracks messages deleted in the last 30 days. macfor collects the ROWID and GUID of each entry; the message content is not recovered
  • Reactions: Tapback reactions are stored as separate message records with association metadata
  • Group chats: chat_handle_join maps participants to conversations
  • Timestamp precision: Messages uses Core Data timestamps in nanoseconds (not seconds)

Core Data Nanosecond Timestamps

Messages uses nanosecond-precision Core Data timestamps:

timestamp_seconds = (nanosecond_value / 1e9) + 978307200

Related Artifacts

  • Contacts - Handle identifiers map to contact records
  • FaceTime - Call records from the same contacts
  • Pattern of Life - InteractionC tracks cross-app messaging patterns

References

Data sources

chat.dbSQLite

~/Library/Messages/

All iMessage, SMS, MMS, and RCS messages with conversation metadata

Attachments/Various

~/Library/Messages/Attachments/

Attachment metadata (file paths, MIME types) read from chat.db; the attachment files themselves are not copied