I’m a digital (as well as physical) packrat. I have all my emails going back to 1994, most of the documents I’ve created in that time (as many as allowed by my previous employers) and a whole collection of IMs. The text messaging on my phone has always been a missing bit of data - until now there’s been no good way to get it off of my phone.
As details have emerged on the iPhone’s internal data structures, I realized that there might be a chance to extract those text messages and archive them offline. Also looks like voicemails can be archived in a similar fashion. I’m almost ready to share the utility with the world, but until then I thought I’d share my iPhone database structure notes. For those geeks interested in such matters, click through to the extended entry. (Thanks to Erica Sadun for porting sqlite3 to the iPhone - made this whole thing much easier)
SMS DB
/private/var/root/Library/SMS/sms.db
| TABLE | _SqliteDatabaseProperties | |
| key (TEXT) | value (TEXT) |
| _ClientVersion | 2 |
| _UniqueIdentifier | GUID |
| TABLE | message | |
| ROWID (INTEGER PRIMARY KEY AUTOINCREMENT) |
| Auto-incrementing field/counter |
| address (TEXT) |
| International-formatted foreign address |
| (18005551212) |
| date (INTEGER) |
| OSX-epoch based datetime, convertable via date -r |
| (1187200801) |
| text (TEXT) |
| Content of text message |
| (This is the text message) |
| flags (INTEGER) |
| Flags controlling the type of record |
| 2 - Message sent from address to iPhone |
| 3 - Message sent from iPhone to address |
| 129 - Message log erased from iPhone but addressee still in SMS index |
| replace (INTEGER) |
| Unknown, always 0 in my case |
| svc_center (TEXT) |
| service center, seems null in my case |
CallData DB
/System/Library/Frameworks/AppSupport.framework/calldata.db
| TABLE | _SqliteDatabaseProperties |
| TABLE | citycode | |
| code (INTEGER) |
| Not sure what the significance of these entries are, I’m wondering if they have something to do with the geocoding of calls not made from your phonebook? |
| (3888) |
| city (TEXT) |
| Not sure what the significance of these entries are, I’m wondering if they have something to do with the geocoding of calls not made from your phonebook? |
| (RED CLOUD) |
| INDEX | citycode_codeIndex |
| citycode (code) |
| TABLE | npa | |
| npa (TEXT) |
| Numbering Plan Area, aka Area Code |
| (415) |
| location (TEXT) |
| State/Province Assigned to the NPA |
| (CA) |
| country (TEXT) |
| Country Assigned to the NPA, may be null if “location” is specific enough |
| (USA) |
| TABLE | npalocation | |
| npa (TEXT) |
| Numbering Plan Area, aka Area Code |
| (415) |
| location (TEXT) |
| Descriptive location info |
| (San Francisco/North Bay Area) |
| TABLE | npanxx | |
| npa (INTEGER) |
| Numbering Plan Area, aka Area Code |
| (907) |
| nxx (INTEGER) |
| Unknown |
| (200) |
| rate_center (INTEGER) |
| Unknown |
| (1) |
| INDEX | npanxx_npanxxIndex |
| npanxx (npa,nxx) |
CallHistory DB
/private/var/root/Library/CallHistory/call_history.db
| TABLE | _SqliteDatabaseProperties | |
| your values will certainly be different here…when you “restore” your iPhone from iTunes the counters all reset |
| key (TEXT) | value (TEXT) |
| call_history_limit | 100 |
| timer_last | 60 |
| timer_outgoing | 900 |
| timer_incoming | 540 |
| timer_all | 1440 |
| timer_lifetime | 1440 |
| timer_last_reset |
| data_up_last | 2.5439454125 |
| data_down_last | 20.86328125 |
| data_up_all | 719.9228515625 |
| data_down_all | 8677.8427734375 |
| data_up_lifetime | 719.9228515625 |
| data_down_lifetime | 8677.8427734375 |
| data_last_reset |
| _ClientVersion | 3 |
| _UniqueIdentifier | GUID |
| TABLE | call | |
| ROWID (INTEGER PRIMARY KEY AUTOINCREMENT) |
| Auto-incrementing field/counter |
| address (TEXT) |
| International-formatted foreign address |
| (18005551212) |
| date (INTEGER) |
| OSX-epoch based datetime, convertable via date -r |
| (1187200801) |
| duration (INTEGER) |
| Length of call in seconds rounded to next minute, 0 = missed call |
| (60) |
| flags (INTEGER) |
| Flags controlling the type of record |
| 5 - Outgoing call |
| 4 - Incoming call |
| id (INTEGER) |
| AddressBook ID for outgoing calls selected from AddressBook, otherwise -1 |
| (67) |
| INDEX | date_index |
| call (date) |
KeyChain DB
/private/var/root/Library/Keychains/keychain-2.db
Encrypted, I don’t know how to parse this yet
Notes DB
/private/var/root/Library/Notes/notes.db
| TABLE | _SqliteDatabaseProperties | |
| key (TEXT) | value (TEXT) |
| _ClientVersion | 2 |
| _UniqueIdentifier | GUID |
| TABLE | Note | |
| creation_date (INTEGER) |
| title (TEXT) |
| summary (TEXT) |
| TABLE | note_bodies | |
| note_id (INTEGER UNIQUE) |
| data |
Voicemail DB
/private/var/root/Library/Voicemail/voicemail.db
| TABLE | _SqliteDatabaseProperties | |
| key (TEXT) | value (TEXT) |
| VMVersion | 4 |
| _UniqueIdentifier | GUID |
| token | string containing various values, including your phone number |
| uid_validity | 1183172695 |
| mailboxusage | 57 |
| TABLE | voicemail | |
| ROWID (INTEGER PRIMARY KEY AUTOINCREMENT) |
| Auto-incrementing field/counter |
| remote_uid (INTEGER) |
| International-formatted foreign address |
| (18005551212) |
| date (INTEGER) |
| OSX-epoch based datetime, convertable via date -r |
| (1187200801) |
| token (TEXT) |
| Always reads “Complete” from what I can tell |
| sender (TEXT) |
| CallerID from the calling party leaving the voicemail message |
| (8885551212) |
| callback_num (TEXT) |
| Callback number left by calling party, usually caller ID |
| (8885551212) |
| duration (INTEGER) |
| Duration in seconds |
| (5) |
| expiration (INTEGER) |
| OSX-epoch based datetime, convertable via date -r |
| (1189431482) |
| trashed_date (INTEGER) |
| definitely based in seconds, haven’t figured out the epoch yet or why it isn’t the same as the other dates based on OSX’s epoch |
| flags (INTEGER) |
| Voicemail flags |
| 0 - Not downloaded yet |
| 1 - Partially downloaded |
| 2 - New, unlistened or only partially listened to |
| 3 - Listened completely |
| 11 - Pending delete, in “Deleted Items” |
| 15 - Deleted from iPhone, pending delete from voicemail hq |
| INDEX | date_index |
| voicemail (date) |
| INDEX | remote_uid_index |
| voicemail (remote_uid) |
Other, more complicated DBs, involved in syncing
AddressBook DB
/private/var/root/Library/AddressBook/AddressBook.sqlitedb
AddressBook Images DB
/private/var/root/Library/AddressBook/AddressBookImages.sqlitedb
Maptiles DB
/private/var/root/Library/Caches/MapTiles/MapTiles.sqlitedb
Calendar DB
/private/var/root/Library/Calendar/Calendar.sqlitedb
Comments (1)
Have you been able to extract the SMS messages from the iPhone database. I have seen a few posts elsewhere claiming to run a script but I do not know how to do that yet...help would be greatly appreciated
Posted by Jesse Garcia | June 30, 2008 12:29 AM
Posted on June 30, 2008 00:29