iPhone backup database hashes: which filenames do they use?

Updated
Cover image for: iPhone backup database hashes: which filenames do they use?

When an iTunes or an iCloud backup is performed for your iPhone, iPad or iPod Touch, important data is saved into various files within the backup folder.

The filenames are encoded so they appear as strings of letters and numbers if you access the backup folder, using what is known as a hex-encoded SHA-1 hash. In many versions of the iPhone operating system the same names are used.

Here are some of the core SQLite database files found in the iTunes backup folder. The file names are the same for both iTunes and iCloud backups.

iOS 13, 12 and 11 iPhone backup file locations

Contents Real filename Backup filename
SMS sms.db 3d0d7e5fb2ce288813306e4d4636395e047a3d28
Contacts AddressBook.sqlitedb 31bb7ba8914766d4ba40d6dfb6113c8b614be442
Calendar Calendar.sqlitedb 2041457d5fe04d39d0ab481178355df6781e6858
Reminders Calendar.sqlitedb 2041457d5fe04d39d0ab481178355df6781e6858
Notes notes.sqlite ca3bc056d4da0bbf88b5fb3be254f3b7147e639c
Notes NoteStore.sqlite 4f98687d8ab0d6d1a371110e6b7300f6e465bef2
Call history call_history.db 2b2b0084a1bc3a5ac8c27afdf14afb42c61a19ca
Call history CallHistory.storedata 5a4935c78a5255723f707230a451d79c540d2741
Locations consolidated.db 4096c9ec676f2847dc283405900e284a7c815836
Web history History.db e74113c185fd8297e140cfcf9c99436c5cc06b57
Voicemail voicemail.db 992df473bbb9e132f4b3b6e4d33f72171e97bc7a
Photos Photos.sqlite 12b144c0bd44f2b3dffd9186d3f9c05b917cee25

iOS 10, 9, 8 and 7 iPhone backup file locations

Contents Real filename Backup filename
SMS sms.db 3d0d7e5fb2ce288813306e4d4636395e047a3d28
Contacts AddressBook.sqlitedb 31bb7ba8914766d4ba40d6dfb6113c8b614be442
Calendar Calendar.sqlitedb 2041457d5fe04d39d0ab481178355df6781e6858
Reminders Calendar.sqlitedb 2041457d5fe04d39d0ab481178355df6781e6858
Notes notes.sqlite ca3bc056d4da0bbf88b5fb3be254f3b7147e639c
Call history call_history.db 2b2b0084a1bc3a5ac8c27afdf14afb42c61a19ca
Call history CallHistory.storedata 5a4935c78a5255723f707230a451d79c540d2741
Locations consolidated.db 4096c9ec676f2847dc283405900e284a7c815836
Photos Line.sqlite 2d711a1f5613f5259730b98328a3f7e816698f88

The paths to the WhatsApp, Snapchat, Kik, Viber and WeChat databases are mentioned in the table below. These filenames are available for iOS 8 and 9 but have different names for the older versions of iOS.

Chat app Stored to Backup filename
WhatsApp App Domain/net.whatsapp.WhatsApp/, Documents/ChatStorage.sqlite 1b6b187a1b60b9ae8b720c79e2c67f472bab09c0, 275ee4a160b7a7d60825a46b0d3ff0dcdb2fbc9d, 7c7fba66680ef796b916b067077cc246adacf01d
Snapchat App Domains/com.toyopagroup.picaboo/, Documents/chats.plist (private messages) or stories.plist (public snaps) 1cd3cd2b412f7b045dd479b617cb2a4f99ffdfee, 7cdb9af6c5352b97cc0f87369df43c49a45c99f3
Kik App Domain/group.com.kik.chat/, cores/private/…/kik.sqlite 8e281be6657d4523710d96341b6f86ba89b56df7
Viber App Domain/com.viber/, Documents/Contacts.data b39bac0d347adfaf172527f97c3a5fa3df726a3a
WeChat App Domain/com.tencent.xin/, Documents/DB/MM.sqlite (Varies dynamically)
Line Photos.sqlite 12b144c0bd44f2b3dffd9186d3f9c05b917cee25

iOS 6 iPhone backup filenames

Contents Real filename Backup filename
SMS sms.db 3d0d7e5fb2ce288813306e4d4636395e047a3d28
Contacts AddressBook.sqlitedb 31bb7ba8914766d4ba40d6dfb6113c8b614be442
Calendar Calendar.sqlitedb 2041457d5fe04d39d0ab481178355df6781e6858
Reminders Calendar.sqlitedb 2041457d5fe04d39d0ab481178355df6781e6858
Notes notes.sqlite ca3bc056d4da0bbf88b5fb3be254f3b7147e639c
Call history call_history.db 2b2b0084a1bc3a5ac8c27afdf14afb42c61a19ca
Locations consolidated.db Removed from iTunes backup, not iOS

iOS 5 iPhone backup filenames

Contents Real filename Backup filename
SMS sms.db 3d0d7e5fb2ce288813306e4d4636395e047a3d28
Contacts AddressBook.sqlitedb 31bb7ba8914766d4ba40d6dfb6113c8b614be442
Calendar Calendar.sqlitedb 2041457d5fe04d39d0ab481178355df6781e6858
Reminders Calendar.sqlitedb 2041457d5fe04d39d0ab481178355df6781e6858
Notes notes.sqlite ca3bc056d4da0bbf88b5fb3be254f3b7147e639c
Call history call_history.db 2b2b0084a1bc3a5ac8c27afdf14afb42c61a19ca
Locations consolidated.db Removed from iTunes backup, not iOS

iOS 4 iPhone backups filenames

Contents Real filename Backup filename
SMS sms.db 3d0d7e5fb2ce288813306e4d4636395e047a3d28
Contacts AddressBook.sqlitedb 31bb7ba8914766d4ba40d6dfb6113c8b614be442
Calendar Calendar.sqlitedb 2041457d5fe04d39d0ab481178355df6781e6858
Notes notes.sqlite ca3bc056d4da0bbf88b5fb3be254f3b7147e639c
Call history call_history.db 2b2b0084a1bc3a5ac8c27afdf14afb42c61a19ca
Locations consolidated.db 4096c9ec676f2847dc283405900e284a7c815836

iOS 3 iPhone backup filenames

Contents Real filename Backup filename
SMS sms.db 3d0d7e5fb2ce288813306e4d4636395e047a3d28
Contacts AddressBook.sqlitedb 31bb7ba8914766d4ba40d6dfb6113c8b614be442
Calendar Calendar.sqlitedb 2041457d5fe04d39d0ab481178355df6781e6858
Notes notes.db 740b7eaf93d6ea5d305e88bb349c8e9643f48c3b
Call history call_history.db ff1324e6b949111b2fb449ecddb50c89c3699a78

iOS 2 iPhone backup filenames

Contents Real filename Backup filename
SMS sms.db 3d0d7e5fb2ce288813306e4d4636395e047a3d28
Contacts AddressBook.sqlitedb 31bb7ba8914766d4ba40d6dfb6113c8b614be442
Calendar Calendar.sqlitedb 2041457d5fe04d39d0ab481178355df6781e6858
Notes notes.db 740b7eaf93d6ea5d305e88bb349c8e9643f48c3b
Call history call_history.db ff1324e6b949111b2fb449ecddb50c89c3699a78

iOS 1 iPhone backup filenames

Contents Real filename Backup filename
SMS sms.db 3d0d7e5fb2ce288813306e4d4636395e047a3d28
Contacts AddressBook.sqlitedb adb8c77534444e97c31ff15924d50f3ed1fbd3b1
Calendar Calendar.sqlitedb 14ee8cdc3e6e0220399ff210246e1c92b7df89a0
Notes notes.db 740b7eaf93d6ea5d305e88bb349c8e9643f48c3b
Call history call_history.db a49bfab36504be1bf563c1d1813b05efd6076717

As you’ve seen, it’s rather difficult to work with files named like this. If you'd like an easier way to tell what's in your iTunes or iCloud backup, we provide a tool that does all this decoding for you. Take a look at iPhone Backup Extractor.

About the author

Andy Coles has been building and documenting iPhone Backup Extractor since it was first released. He's made a number of discoveries in the field of data recovery, most notably techniques for transferring data between iPhone backups.

Reincubate's CEO at Buckingham Palace

Pictured above are members of Reincubate’s team meeting HM Queen Elizabeth Ⅱ at Buckingham Palace, after being awarded the UK’s highest business award for our work with Apple technology. Read our position on privacy, safety and security.

We've helped over 10,000,000 people recover their lost iPhone data. Let us help you too.

Comments (6)

Good morning,

Could you please help me out with the following: the WhatsApp backup file 275ee4a160b7a7d60825a46b0d3ff0dcdb2fbc9d does not exist in the backup file (C:/user/user/appdata/roaming/apple computer/mobile sync//backup (Apple IOS 10).

Have the backup file names changed? Please help me locating these files for IOS 10. Highly appreciated, kind regards,

Eric Stam

Hi Eric, thanks for asking! Yes, the names do change between backup versions. The easiest approach is to use the free edition of iPhone Backup Extractor: it'll let you pull out the file you need without having to look up the code. 🕵️‍♀️

iOS 10 backup: Manifest.db is an SQLite database, with a "Files" table containing all the cryptic backup file names with their corresponding actual file names and paths.

That's right. But not if it's an encrypted backup, which it should be for your safety!

Hi Andrew, the information you have shared with us is very productive, Thanks :) Can you please help me out about the file name for messenger in iPhone backup? I really appreciate your response.

Hi Kokil, thanks for your kind words! Facebook Messenger scatters its data over a whole series of files, and many of them have hashes in their names that'll very from phone to phone. You're best off looking in iPhone Backup Extractor's expert mode. The folder you'll be after is /Applications/com.facebook.Messenger. Happy hunting!

Hello,

Where are the mail settings, user and password saved?

Where is the safari password list stored?

Same for facebook?

Thank you in advance for your prompt feedback

Hi LicSKY, thanks for asking! I sense you're looking for passwords. Whilst mail settings are stored in backups the password for your email and Facebook won't be included there.

That Safari password list is included in your "key bag", and that can be found in /Keychain/TrustStore.sqlite3.

Please I will be needing help from you. I just got this Iphone 5 and trying to activate it was told it has being activated with another person's account. what can I do to remove the person's account I tried everything I could please

Hi Alex, this is Apple's iCloud activation lock. It's an important feature that prevents trafficking of stolen phones. The only way for that lock to be removed is it the person who signed in to the phone either signs out of the phone, or removes it from their iCloud account. Alternately, if you can take a receipt showing proof of purchase to an Apple Store, they can remove the lock for you.

If someone has sold you a phone that's already locked, it's practically worthless: you may want to ask for your money back!

Thx it was useful. It helped me a lot!


Can we improve this article?

We love hearing from users: why not drop us an email, leave a comment, or tweet @reincubate?

© 2008 - 2019 Reincubate Ltd. All rights reserved. Registered in England and Wales #5189175, VAT GB151788978. Reincubate® is a registered trademark. Privacy & terms. We recommend 2FA. Built with in London.