3

This question already has an answer here:

I am looking to understand if it is possible to create fake messages (Apple iMessages) that can appear to be messages that were created years ago? I have read that using SQlite a person can modify and create messages. Is that really the case? And if so, how can you verify if those messages are fake?

marked as duplicate by Arminius, Steffen Ullrich, forest, schroeder May 28 '18 at 6:57

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

0

If you can create iMessages using SQLite, then you need to root the phone. So if the phone is rooted, you can't trust these messages.

Another case would be if you rooted the phone and then unrooted it, this way one can perfectly fabricate it.

Another thing is analysis of the SQLite file. If you add records to appear as they are yeards old, but in the file they are added at the end, then you might conclude these are fabricated. This also can be sorted by redumping the SQLite file, so exporting it to SQL queries and importing into file again. This way records will look like they have been saved years ago.

So by unrooting the phone and redumping the sqllite file you can pefectly fabricate it. You would need to unroot in a way to not leave any traces of rooting.

Finally you would need to make sure on the flash there are no old copies of SQLLite file.

  • Can you give me your thoughts on the follow scenario: Is it possible for someone to take a iphone and get the database that has the iMessages (with or without jailbreaking the iphone) and get the iMessage database onto a laptop where they could create new iMessages that are backdated to several years ago...then save the changes to the database and then get the modified iMessage database file back onto another new iPhone which was not jailbroken/rooted, or even an iCloud backup? – AmericanDream Jan 27 '18 at 23:59
  • No, not possible with current known tools – John Keates Jan 28 '18 at 1:18
  • @JohnKeates what is your thought on the answer above from Aria where he/she says that using SQLite makes backdating possible? – AmericanDream Jan 28 '18 at 1:32
  • It would depend on the iMessage settings. If iCloud sync is on and other devices are logged in, it will not work. Regarding single-unsynchronised clients, it might work as long as you have bare filesystem access (which you only have on jailbroken devices) – John Keates Jan 28 '18 at 1:43
  • If a iMessage database was modified from a jailbroken device, then uploaded back up to an icloud account so it could be installed into a new, non-jailbroken iphone device....is there any way to verify that the database has been messed with? – AmericanDream Jan 28 '18 at 2:13

Not the answer you're looking for? Browse other questions tagged or ask your own question.