iMessage
Overview
Evidence: iMessage
Description: Collect iMessages
Category: System
Platform: macos
Short Name: imsg
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): Yes
Background
iMessage chat database stores messages, attachments, and metadata per user. This data is essential for communications analysis and timeline reconstruction.
Data Collected
This collector gathers structured data about imessage.
iMessage Data
| Field | Description | Example |
|---|---|---|
User | User | Example value |
MessageID | Message ID | 123 |
Conversation | Conversation | 123 |
Text | Text | Example value |
Contact | Contact | Example value |
Direction | Direction | Example value |
Account | Account | Example value |
Date | Date | 2023-10-15 14:30:25+03:00 |
DateRead | Date Read | 2023-10-15 14:30:25+03:00 |
DateDelivered | Date Delivered | 2023-10-15 14:30:25+03:00 |
IsFromMe | Is From Me | 123 |
IsRead | Is Read | 123 |
DestinationCallerID | Destination Caller ID | Example value |
AttachmentPath | Attachment Path | Example value |
AttachmentName | Attachment Name | Example value |
AttachmentSize | Attachment Size | 123 |
Collection Method
This collector copies user chat.db files and queries messages, attachments, and related tables, recording into imessage.
Forensic Value
This evidence is crucial for forensic investigations as it reveals communications content, participants, and attachment artifacts.