iMessage Forensics: Reconstruct, Recover and Report

iPhone message history sits in an SQLite database on the device. It travels into two kinds of evidence an examiner can work. The first is an encrypted MobileBackup2 backup, which any unlockable device yields through Apple's supported path. The second is a full-filesystem extraction, which Cellebrite UFED or VeraKey class tooling produces. Sherlock Forensics iPhone Analyzer reads both, so message analysis does not depend on which route the evidence took to reach you.

The database is richer than the Messages app lets on. Alongside the visible threads it holds delivery and read metadata, group membership records, reaction records and, critically for investigations, freed pages where deleted records linger until the database overwrites them. A forensic reconstruction has to handle all of that faithfully: presenting what is live, recovering what survives and never blurring the two.

Sherlock reconstructs iMessage and SMS as threaded conversations: who said what, in order, with the attachments inline. HEIC images decode and HEVC video plays in-app, so the media a thread exchanged is reviewable where it was exchanged rather than in a separate export. Dedicated views split the same data by investigative angle: Conversations for thread-level review, Chats and Groups for membership, Message Attachments for the media set, Contacts for attribution.

Accuracy details that survive cross-examination are built in. Tapback reactions are distinguished from typed messages in the timeline, the thread views and the counts, so a thumbs-up on a message is never presented as an original communication and message totals are never inflated by reactions. Group-membership events, participants added or removed, group names changed, are labeled as events rather than rendered as cryptic blanks. What the examiner presents is what the conversation was.

The most asked question in message forensics deserves a straight answer. When a subject deletes a message, iOS marks the record's database page as free rather than erasing it on the spot. Until new writes claim that page, the deleted record is physically still there. Sherlock carves it back out through standard freed-page carving. The same applies to deleted calls and contacts across the artifact set.

What survives is therefore a function of time and device activity, not tool marketing. A message deleted hours before acquisition on a lightly used phone is very likely recoverable. A message deleted months ago on a busy phone has probably been overwritten and no tool recovers it. Sherlock flags every carved record as recovered in the interface and in the report, so an examiner can state on the record which messages were live and which were recovered and can explain the survival logic without overclaiming.

This is the same physics every carving tool works under. The differentiator worth paying for is honest labeling and defensible methodology, not a bigger promised recovery number.

A thread rarely proves a case alone; it proves it alongside where the device was and what it was doing. Every message event feeds the merged Activity Timeline, so a conversation reads in sequence with calls, photo captures, web activity and, from full-filesystem depth, location transitions and app usage around the same minutes. The Communication Map and Communication Insights views turn message volume into relationship evidence: top contacts, unknown handles the subject messaged but never saved and per-contact activity over time.

Global search and keyword-watchlist search run across every thread and every artifact at once, so the name, address or phrase a case turns on surfaces wherever it appears, in a message body, a contact card or a Safari search. Items flagged during review roll directly into the report.

iMessage is rarely the whole conversation record. From the same encrypted backup, Sherlock reconstructs WhatsApp messages and groups, including members, admins and JIDs, a genuine iOS advantage since the encrypted backup carries the WhatsApp database that app-private storage locks away on non-rooted Android. Voicemail and call history sit alongside the threads, so the conversation record and the call record read together.

From full-filesystem depth the recovery surface widens further: chat recovered from on-device web caches for Skype, Facebook Messenger, Instagram and TikTok direct messages, Discord, Reddit and others, with delivered-notification previews that survive in-app deletion. Those recoveries are labeled for what they are, web-cache and notification-preview content for apps whose message stores are not directly readable, never passed off as full message-database extractions. The parser list maps the whole messaging surface to the source each piece reads from.

For a case that turns on conversations, the practical sequence is simple: open the evidence free, read the Messages and WhatsApp views first, then let the timeline and the communication views tell you which of the other channels mattered to the people involved.

Message evidence reaches courtrooms under scrutiny. The reporting is built for it: case and evidence numbers, examiner identification, disclosed acquisition methodology, per-artifact SHA-256 hashing and an optional evidence-integrity manifest, with recovered records flagged throughout, the documentation elements described in NIST Special Publication 800-101 Revision 1, Guidelines on Mobile Device Forensics. Analysis is 100 percent read-only; the evidence file is never modified.

Built by CISSP, ISSAP and ISSMP certified examiners with 20 years of courtroom experience. Admissibility always depends on jurisdiction, authority to examine the device and the examiner's own evidence handling; the report documents what courts typically require so that testimony rests on the record rather than on recollection.

No tool reads messages from a locked device you cannot unlock; Sherlock requires the passcode and the Trust prompt for its own logical acquisition and does not bypass either. Messages that never reached this device's database, iCloud-only content that never synced, are out of a local examination's scope and need credentials or legal process through a different route. Deleted records already overwritten by the database are gone. Sherlock states each of these limits in its results rather than papering over them, because the examiner has to state them on the stand either way.

Download the free edition, open the backup or extraction in front of you and read the threads. Unlock the full history when the case calls for it: $599 one-time, no subscription.

Get Sherlock Forensics iPhone Analyzer

Related: Product page · The full parser list · Analyze an extraction received in discovery