iPhone and iOS Forensics

• ROWID: A sequential, unique number assigned to each row in the msg_pieces table (not necessarily unique to each message). The “sqlite_sequence” table tracks the last assigned ROWID for the msg_pieces table as well as the other tables in the database.

• message_id: A unique ID assigned to each message. Typically, an MMS record will contain three rows in the msg_pieces database: the first row has blank/zero/null data, the second row contains the message within a text/plain document, and the third row is the actual image that was attached. All three of these rows comprise one MMS message, and will all have the same message_id. A message ID in the msg_pieces table matches up with the ROWID in the message table.

• data: The text content that ...