Pro plugin

Messages (iMessage/SMS/RCS)

Collects iMessage, SMS, MMS, and RCS conversations, attachments, reactions, and deleted messages from macOS Messages.app

messages.applePromacOS 10.12+v1.0.0messagingusercommunication

Run this plugin

Trigger collection for Messages (iMessage/SMS/RCS) on its own with the --plugin flag, or include it in a wider sweep by category.

# Just this plugin
macfor-pro collect --plugin messages.apple --output ./evidence.zip

# Dry run — list what would be collected
macfor-pro collect --plugin messages.apple --dry-run

Compatibility

macOS 10.12+

Licensing: ships in the macfor-pro binary. See Community vs Pro.

Artifacts (6 collected)

Each row corresponds to an entry in the plugin's artifacts.yaml manifest. Optionalartifacts are often absent, and their absence isn't recorded as an error. Plannedartifacts are documented locations the plugin doesn't collect yet. Where a path shows a version range, macfor only tries it when the source's macOS or application version is in that range.

messaging

Artifact	Format	Path	Notes
Chat Database chat_databasecritical value	sqlite	`~/Library/Messages/chat.db` +1 more `~/Library/Containers/com.apple.iChat/Data/Library/Messages/chat.db`	Tables: message, handle, chat, attachment, deleted_messages, chat_handle_join, chat_message_join, message_attachment_join
Messages messagescritical value	jsonl	`~/Library/Messages/chat.db`	—
Attachment Metadata attachmentsOptionalhigh value	jsonl	`~/Library/Messages/Attachments/`	Metadata only; actual files are not collected by default
Reactions (Tapbacks) reactionsOptionalmedium value	jsonl	`~/Library/Messages/chat.db`	—
Deleted Messages deleted_messagesOptionalcritical value	jsonl	`~/Library/Messages/chat.db`	—
Group Chat Metadata group_chatsOptionalhigh value	jsonl	`~/Library/Messages/chat.db`	—