It took me a while until I would finally face the issue about iMessages (and their date). The latest released version of the SMS extractor was able to deal with iOS 5 containers and would already also extract iMessages – however with a wrong date.

In order to fix this, I had to treat iMessages as a special case. Thing is, in order to still be able and deal with container files prior to iOS 5 (and the program stay universal), the fact whether iMessages can appear needs to be determined before the actual message retrieval is done. So far I’ve been too lazy to approach this issue, that’s why it took a while. (And yes, I hate legacy support, but I hate it even more when users are left out who don’t or can’t update for some reason!)

Thanks to Tom Offermann a.k.a. toffer (over at github) I now know that iMessages store their date starting to count seconds since 01.01.2001. So converting that into a human readable timestamp needs to be done differently than normal text messages. Furthermore iMessages carry new special flags (madrid_flags), which determine whether an iMessage was sent or received (among other additional information). These new flags were also taken into account to keep up the feature of extracting only incoming or outgoing messages.

You can retrieve the code of the updated standalone version here.

This work is licensed under a Creative Commons Attribution 3.0 Unported License.

In case you need instructions on how to work with the standalone version, please refer to the very original release post.

Also, naturally, the update was included in the online version of the extractor!