What iMessage Keeps After You Edit, Unsend, React or Delete: Database Evidence from Nine iPhone Databases on iOS 18 to 26

Recent iOS releases let a sender edit, unsend, react to and reply inline to an iMessage, and keep deleted messages recoverable for a period. Examiners must say which of these states a conversation was in, yet the public descriptions we found of how the Messages database (sms.db) records each action rest largely on single-device observation and tool documentation. We state each storage model as equalities that must hold if the model is right and count the exceptions over every instance in nine sms.db databases from iPhone full file system extractions (iOS 18.1.1 and 26.2.1 to 26.6.2). The edit-history model held: the time of the last stored version equals date_edited on 466 of 466 edited messages. Unsent messages keep their row but not their text. Three plausible readings failed. reply_to_guid is filled on 73 percent of the rows of one iOS 26.5.2 database and equals the reply originator in only 56 of 1,360 replies, so it does not mark replies; Recently Deleted rows are not confined to 30 days; and most reaction removal rows have no matching add row, as exporter documentation predicts. On these databases, replies should therefore be identified by the thread originator, not by reply_to_guid.

Authors

Institutions

Publication Details

Journal
Zenodo (CERN European Organization for Nuclear Research)
Published
2026-10-27
DOI
https://doi.org/10.5281/zenodo.23717930
Primary Topic
Digital and Cyber Forensics
Type
preprint
Controls
|||
ALL TIME
JAN
FEB
MAR
APR
MAY
JUN
JUL
AUG
SEP
OCT
preprint

What iMessage Keeps After You Edit, Unsend, React or Delete: Database Evidence from Nine iPhone Databases on iOS 18 to 26

Daniel Kwaku Ntiamoah Addai
Zenodo (CERN European Organization for Nuclear Research)
Digital and Cyber Forensics
preprint

What iMessage Keeps After You Edit, Unsend, React or Delete: Database Evidence from Nine iPhone Databases on iOS 18 to 26

Daniel Kwaku Ntiamoah Addai
preprint en

Abstract

Recent iOS releases let a sender edit, unsend, react to and reply inline to an iMessage, and keep deleted messages recoverable for a period. Examiners must say which of these states a conversation was in, yet the public descriptions we found of how the Messages database (sms.db) records each action rest largely on single-device observation and tool documentation. We state each storage model as equalities that must hold if the model is right and count the exceptions over every instance in nine sms.db databases from iPhone full file system extractions (iOS 18.1.1 and 26.2.1 to 26.6.2). The edit-history model held: the time of the last stored version equals date_edited on 466 of 466 edited messages. Unsent messages keep their row but not their text. Three plausible readings failed. reply_to_guid is filled on 73 percent of the rows of one iOS 26.5.2 database and equals the reply originator in only 56 of 1,360 replies, so it does not mark replies; Recently Deleted rows are not confined to 30 days; and most reaction removal rows have no matching add row, as exporter documentation predicts. On these databases, replies should therefore be identified by the thread originator, not by reply_to_guid.

Zenodo (CERN European Organization for Nuclear Research)
Prudential Financial (United States) (US)
Digital and Cyber Forensics
AI Navigator

Ask Laika to Summarize, Analyze, and Connect papers live on the map.

Summarize Papers & Methodologies

Extract key findings, datasets, and comparative methods across publications.

Benchmark Rankings & Visual Analytics

Rank top research institutions, authors, funders, topics, and journals by Field-Weighted Citation Impact (FWCI) and paper volume with instant charts.

Connect Distant Disciplines

Bridge topological clusters on the map to find hidden collaborative intersections.

Laika access coming soon