iMessage

Overview

Evidence: iMessage Description: Collect iMessages Category: System Platform: macos Short Name: imsg Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): Yes

Background

iMessage chat database stores messages, attachments, and metadata per user. This data is essential for communications analysis and timeline reconstruction.

Data Collected

This collector gathers structured data about imessage.

iMessage Data

Field	Description	Example
User	User	Example value
MessageID	Message ID	123
Conversation	Conversation	123
Text	Text	Example value
Contact	Contact	Example value
Direction	Direction	Example value
Account	Account	Example value
Date	Date	2023-10-15 14:30:25+03:00
DateRead	Date Read	2023-10-15 14:30:25+03:00
DateDelivered	Date Delivered	2023-10-15 14:30:25+03:00
IsFromMe	Is From Me	123
IsRead	Is Read	123
DestinationCallerID	Destination Caller ID	Example value
AttachmentPath	Attachment Path	Example value
AttachmentName	Attachment Name	Example value
AttachmentSize	Attachment Size	123

Collection Method

This collector copies user chat.db files and queries messages, attachments, and related tables, recording into imessage.

Forensic Value

This evidence is crucial for forensic investigations as it reveals communications content, participants, and attachment artifacts.