Where are text messages stored in an iPhone backup?

What the hex filenames mean, which one holds your messages, and what you can actually do with it once you've found it.

If you've opened an iPhone backup folder expecting to find something readable, you instead found thousands of files with names like 3d0d7e5fb2ce288813306e4d4636395e047a3d28 and no extensions, sorted into 256 folders named 00 through ff. Nothing is missing. Apple renames every file in a backup, and there is a rule behind it.

The file you want is 3d0d7e5fb2ce288813306e4d4636395e047a3d28

That is your Messages database. It is a normal SQLite file called sms.db containing every SMS and iMessage on the phone: the text, the timestamps, who sent what, group chat membership, and references to attachments.

Because of the folder sharding, it will not be loose in the backup folder. It sits in the subfolder named after the first two characters of its own name:

<backup folder>/3d/3d0d7e5fb2ce288813306e4d4636395e047a3d28

Why the names look like that

Every file in a modern iPhone backup is renamed to the SHA-1 hash of its domain and its original path, joined with a hyphen. For the Messages database, the original location on the phone is Library/SMS/sms.db inside HomeDomain, so the name is the SHA-1 of:

HomeDomain-Library/SMS/sms.db

You can verify this yourself in a terminal, which is a good sanity check that you are looking at the right file:

printf 'HomeDomain-Library/SMS/sms.db' | shasum -a 1

The hash is deterministic, so it is identical in every iPhone backup ever made, on every device, on every iOS version that uses this format (iOS 10 and later). That is why searching the string finds other people asking the same question.

Other files people are usually looking for

The same rule produces these, which are the ones that come up most often. Each lives in the subfolder matching its first two characters.

Photo and video attachments do not have fixed hashes. They live in MediaDomain under per-message paths that differ on every phone, so there is no single name to look for. The path is recorded inside sms.db itself, in the attachment table, which is how software matches them back up.

Two things that catch people out

If the backup is encrypted, the file will not open

In an encrypted backup every file is individually AES-encrypted, including Manifest.db. Opening 3d0d7e5fb2ce288813306e4d4636395e047a3d28 in a SQLite viewer will show binary noise rather than an error, which makes it look like you found the wrong file. You didn't. It needs the backup password and a proper key derivation first.

This is worth tolerating rather than avoiding: only encrypted backups contain your Messages attachments, along with saved passwords and health data. An unencrypted backup gives you readable text and no photos.

Your most recent messages may not be in sms.db

SQLite writes new data to a write-ahead log first. If the backup was made while Messages had pending writes, the newest messages sit in sms.db-wal rather than the main database. Copy that file out alongside the main one, keeping both original names, or recent conversations can appear to be missing entirely.

What to do once you've found it

Finding the file is the easy half. It is a database, not a document, so reading it means either querying it or handing it to something that can lay it out.

• Free, technical: if the backup is unencrypted, open the file in DB Browser for SQLite and query the message, chat and handle tables. Timestamps are in Apple epoch (seconds or nanoseconds since 1 January 2001), so they need converting. Encrypted backups need decrypting first, which is where most people stop.
• Free, command line: tools like imessage-exporter can read a Messages database directly and output text or HTML.
• Formatted and readable: our create page reads the backup folder as it is, encrypted or not, does the hash lookup and decryption for you, and lays the conversation out as real message bubbles with the photos and dates in place. It runs entirely in your browser, so neither the backup nor the password is uploaded anywhere.