There is a newer version of the record available.

Published October 27, 2026 | Version 1.0

What iMessage Keeps After You Edit, Unsend, React or Delete: Database Evidence from Nine iPhone Databases on iOS 18 to 26

  • 1. SectraTEK Lab, Prudential Associates

Description

Recent iOS releases let a sender edit, unsend, react to and reply inline to an iMessage, and keep deleted messages recoverable for a period. Examiners must say which of these states a conversation was in, yet the public descriptions we found of how the Messages database (sms.db) records each action rest largely on single-device observation and tool documentation. We state each storage model as equalities that must hold if the model is right and count the exceptions over every instance in nine sms.db databases from iPhone full file system extractions (iOS 18.1.1 and 26.2.1 to 26.6.2). The edit-history model held: the time of the last stored version equals date_edited on 466 of 466 edited messages. Unsent messages keep their row but not their text. Three plausible readings failed. reply_to_guid is filled on 73 percent of the rows of one iOS 26.5.2 database and equals the reply originator in only 56 of 1,360 replies, so it does not mark replies; Recently Deleted rows are not confined to 30 days; and most reaction removal rows have no matching add row, as exporter documentation predicts. On these databases, replies should therefore be identified by the thread originator, not by reply_to_guid.

Other

Lab Technical Report LAB-TR-0008, version 1.0, SectraTEK Lab. Preprint, not peer reviewed. AI-assistance disclosure: The parser code, the data checks and the first draft of this report were produced with AI assistance (Anthropic Claude), as was the revision of the text into its present form. The author directed the work, reviewed the results and the text, and is responsible for the content. Evidence is reported only as aggregate counts and device classes; no personal data, identifiers or message content from the research devices are included. Related code is in the open-source iLEAPP project (MIT); the linked pull request was merged when this record was prepared (2026-10-27).

Files

LAB-TR-0008.pdf

Files (621.0 kB)

Name Size
md5:ff92f7e1602f093b4e41e21a10f65609
621.0 kB Preview Download

Additional details

Related works