Information Technology Reference
In-Depth Information
else "Unknown"
end as type,
case
when date_read > 0
then
datetime(date_read+978307200,'unixepoch')
when date_delivered > 0
then
datetime(date_delivered+978307200,'unixepoch')
else NULL
end as "Date Read/Sent", text
FROM message m, handle hWHERE h.rowid =
m.handle_idORDER BY m.rowid ASC;
sqlite>.exit
SMS Spotlight cache
Spotlight is a device-wide search feature, which allows the user to search across all the
applications on the device. The SMS data is indexed and stored in a database for a quick
search. The SMS Spotlight cache database is a
HomeDomain
file and can be found at
/private/var/mobile/Library/Spotlight/com.apple.MobileSMS/
SMSSeaerchIndex.sqlite
. The file contains both active and deleted SMS mes-
sages. The following screenshot is an example of the output as viewed in SQLite Browser.
This is a great place to recover SMS messages that are no longer present in the SMS data-
base file. Note that the SMS Spotlight cache filename may vary depending on the version
of the iOS device.
The SMS Spotlight Cache file
You can run the following commands to dump the SMS Spotlight cache database into a
CSV file named
smsspotlightcache.csv
:
$sqlite3 smssearchindex.sqlite
SQLite version 3.7.12 2012-04-03 19:43:07
