Viewing Deleted Messages in Your iPhone Backup

Update: Decipher TextMessage can read some deleted texts out of the backup for you. We hope you'll give it a try! http://deciphertools.com  We also have a video about using Decipher TextMessage for recovery on YouTube.

Another Update (2014-12-15): Many things have changed in the database structure of the messages over the years since I wrote this. We have many new tips about deleted message recovery on our newer blog http://deciphertools.com/blog/2014_06_30_guide_to_recover_deleted_text_messages/

Many people who purchase Decipher TextMessage write us asking about the ability to recover deleted messages.  When we say "deleted messages" here, we mean messages that were received and deleted between backups, so that there is no record of the message in a backup.  If you have backed-up your device prior to when the text was deleted, you can use Decipher TextMessage to read the texts in that backup to recover it.  But, the iTunes backup schedule doesn't always nicely coincide with the schedule of our accidents, our fits, or children playing with our phone.  When we get those emails, it tugs at our hearts because we know that you wouldn't be writing if that text wasn't important, and it feels awful having lost it possibly forever.

We're working on adding the ability to read as many deleted messages as we can from the backups, but in the meantime, we wanted to explain why some of your deleted texts may not be totally gone, and how you can go and look for them by hand.

We're going to walk through the steps assuming that you're on a Mac, but the general idea applies on Windows as well.  Also, folks using Windows can check out this very nice walk-though here.

Why your deleted texts may still be around

The iPhone OS stores your texts in a database system called sqlite.  This is relevant because of the way that sqlite handles deleting entries in the database.  When you delete an entry (aka a text), rather than totally obliterating the entry in the database, the entry is just marked as no longer in use, and will be reused later.  There is a chance that the entry for the text you're wishing to see has been recovered and used for a newer text, in which case the text is indeed gone forever.

Looking at all of the messages, including the "deleted" ones

Until we have Decipher TextMessage read those entries waiting to be reused, to look at your deleted messages, you'll have to take a look at the sqllite file by hand.  It's not pretty, but if you know what you're looking for it's doable.  If you haven't already made a backup since the message was created and subsequently deleted, you will need to do so now.  You can force a backup in iTunes by right-clicking on your device under Devices on the left-hand side of iTunes and then selecting "Back Up".

Open Finder and navigate to Home (your username) -> Library -> Application Support -> MobileSync -> Backup.  Within that folder, you will see one or more folders; each one is a backup of a iOS device (iPhone, iPod Touch, iPad).  The awful names are identifiers that iTunes uses to know which device is which, so that it can overwrite the correct backup when it makes a new update of a device.  If you're unsure which folder is for the device that you need to examine, you can use trial and error with the steps below, or if you have Decipher TextMessage 1.5 the folder names are listed in the information window showing which backups were loaded. 

Now that you've found the folder click on the folder to show the files within it.  You'll see more awful file names, either ending in .mddata, .mdinfo, or .mdbackup if you're running iOS 3.1.x (or lower) or ending with nothing if you're running iOS 4.0 (or higher).

The file of interest to us is "3d0d7e5fb2ce288813306e4d4636395e047a3d28" (or "3d0d7e5fb2ce288813306e4d4636395e047a3d28.mddata" or "3d0d7e5fb2ce288813306e4d4636395e047a3d28.mdbackup").  You can find this file in the list by looking through the list (you can alphabetize this list by going to View -> Show View Options and setting the sort order to alphabetical), or by typing in "3d0d" into spotlight in the upper right corner of your finder window.  If you use spotlight, be sure to select to search within just this folder, and by file name.

This file contains the sqllite database for your sms messages.  Right-click on the file and select Open With -> TextEdit.  If TextEdit is not an option yet, select Open With -> Other... and then find TextEdit within the Applications folder.

The top of the file will look like a pile of gibberish, the gibberish is a bunch of sqllite commands about the database table.  If you scroll down a bit, you'll start to see garbage mixed in with the contents of your text messages.  If you squint your eyes a bit and look some more, you'll also see that the phone number for the other party is listed along with the message text (and more sqllite "garbage" of course).

From here, you'll have to explore the file and see what you can find.  Techniques that we find helpful are to search (with command + f) for text that we think was in the message or to search for the other party's phone number, hitting next to jump through all occurrences of it in the file.  It's not glamourous work, but when the deleted message is important, it's worth it!