iMessage
Overview
Section titled “Overview”Evidence: iMessage
Description: Collect iMessages
Category: System
Platform: macos
Short Name: imsg
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): Yes
Background
Section titled “Background”iMessage chat database stores messages, attachments, and metadata per user. This data is essential for communications analysis and timeline reconstruction.
Data Collected
Section titled “Data Collected”This collector gathers structured data about imessage.
iMessage Data
Section titled “iMessage Data”| Field | Description | Example |
|---|---|---|
User | User | Example value |
MessageID | Message ID | 123 |
Conversation | Conversation | 123 |
Text | Text | Example value |
Contact | Contact | Example value |
Direction | Direction | Example value |
Account | Account | Example value |
Date | Date | 2023-10-15 14:30:25+03:00 |
DateRead | Date Read | 2023-10-15 14:30:25+03:00 |
DateDelivered | Date Delivered | 2023-10-15 14:30:25+03:00 |
IsFromMe | Is From Me | 123 |
IsRead | Is Read | 123 |
DestinationCallerID | Destination Caller ID | Example value |
AttachmentPath | Attachment Path | Example value |
AttachmentName | Attachment Name | Example value |
AttachmentSize | Attachment Size | 123 |
Collection Method
Section titled “Collection Method”This collector copies user chat.db files and queries messages, attachments, and related tables, recording into imessage.
Forensic Value
Section titled “Forensic Value”This evidence is crucial for forensic investigations as it reveals communications content, participants, and attachment artifacts.