SMS and MMS messages are stored in the same database. In our experience, this database is also used regardless of what application is used to send the SMS/MMS (that is, sending an SMS through Google Hangouts will populate this database, not the Hangouts database examined here), although third-party apps may also record the data in their own databases.
Package name: com.android.providers.telephony
Files of interest:
- /files
- /databases/:
- mmssms.db
- telephony.db
The files directory contains attachments sent as an MMS, both sent and received.
The telephony.db database is small, but contains one potentially useful source of information:
|
Table |
Description |
|
siminfo |
Contains historical data for all SIMs that have been used in the device, including the ICCID, phone number (if it was stored on the SIM), and the MCC/MNC, which can be used to identify the network provider. |
The mmssms.db database contains all information regarding SMS and MMS messages:
|
Table |
Description |
|
part |
Contains information about files attached to an MMS. Each message will have at least two parts: an SMIL header and the attachment—this can be seen in the mid and ct columns, as well as the file type attached. The _data column provides the path to find the file on the device. |
|
pdu |
Contains metadata about each MMS. The date column identifies when the message was sent or received, in Linux epoch format. The _id column appears to correspond to the mid value in the part column; correlating these values will show the time a specific image was sent. The msg_box column shows the direction of the message (1 = received and 2=sent). |
|
sms |
Contains metadata about each SMS (does not include MMS information). The address column shows the phone number of the remote user, regardless of whether it was a sent or received message. The person column contains a value that can be looked up in the contacts2.db database, and corresponds with raw_contact_id in the data table. The person column will be blank if it was a sent message, or if the remote user is not in the contacts list. The date column shows the timestamp a message was sent in Linux epoch format. The type column shows the direction of the message (1 = received and 2 = sent). The body column displays the content of the message. The seen column indicates whether the message was read (0 = unread and 1 = read); all sent messages will be marked as unread. |
|
words, words_content, words_segdir |
Appears to contain duplicate content of messages; the exact purpose of this table is unclear. |