Recovering and extracting deleted SMSs from your iPhone

Difficulty: Meant for technicians, running on Linux

When you delete SMSs from iPhones, the data isn't actually removed at all. Initially the database entries are simply marked as "deleted", and then later the rows are cleaned away as free space, but even then the data persists if you look for it.

This process relies on a tool called Undark that decodes the data stored in SQLite format databases ( most iPhone and Android databases are SQLite based, as are Firefox browser databases ). You can obtain Undark from http://pldaniels.com/undark.

Recovering your SMSs

Get a copy of libimobiledevice so that you can extract the SMS database from the iPhone
1. idevicebackup2 backup myiphone
2. idevicebackup2 unback myiphone
Should now be a file in the ./myiphone/.../_unback_ tree called 'sms.db', this is what you want.
Run the SMS extractor against the sms.db
1. undark -i sms.db --cellcount-min=30 --cellcount-max=40 > smsdata.txt
2. undark -i sms.db --cellcount-min=30 --cellcount-max=40 --freespace-only >> smsdata.txt
3. view/edit the smsdata.txt file with what ever editor you like