Where Windows stores iPhone backups, and why nothing inside is called sms.db

On Windows an iPhone backup lives in one of two places, depending on which Apple program made it. The Apple Devices app from the Microsoft Store writes to %USERPROFILE%\Apple\MobileSync\Backup, and classic iTunes writes to %APPDATA%\Apple Computer\MobileSync\Backup. Inside either you will find one folder per device, named with the device’s unique identifier, and inside that a few thousand files with names that look like nothing at all. This page explains what those are, because opening one and finding no file called sms.db is where most people give up.

Where exactly does Windows put iPhone backups?

In one of two folders, depending on which Apple program wrote the backup. Paste either of these into the File Explorer address bar:

%USERPROFILE%\Apple\MobileSync\Backup
%APPDATA%\Apple Computer\MobileSync\Backup

The first is the modern one, used by Apple Devices, which is what Microsoft Store installs today. The second is used by iTunes for Windows, which many people still have because it came with a machine years ago and never left.

Both can exist at once, and the same device can appear under both. That happens after someone migrates from iTunes to Apple Devices, or when an interrupted backup leaves a partial folder in one root while a complete older backup sits in the other. If you are hunting for a conversation and the newest folder does not have it, check the other root before concluding it is gone.

The backup is not small. Budget the space the phone says it is using, which for a 128 GB phone that is three quarters full means something like 90 GB free. It usually comes out smaller than that, because apps and media synced from a computer are not copied, but budgeting the full amount means the backup cannot fail halfway through.

This page is about the folder itself. If what you need is the making of the backup, start to finish and with no iCloud involved, that walkthrough is in how to back up iPhone text messages to a PC without iCloud.

What is the UDID folder?

Each subfolder is named after the device’s unique identifier, and that name is the most reliable way to tell two devices apart when a household has several. The format depends on the device’s age. iPhones up to the iPhone X use forty hexadecimal characters. Devices introduced from late 2018 onwards, the iPhone XR and XS and everything after them, use a shorter two part form: eight characters, a hyphen, then sixteen more, 25 characters in all. One device has one format, so a 25 character folder is not a variant spelling of a 40 character one; it is a newer device. The only variant spelling to know about is that some tools print the newer form without its hyphen, and those two spellings do name the same device.

Inside a device folder there are four files that are not renamed, and they are the ones worth knowing:

File	What it is
Manifest.db	A SQLite index of every file in the backup: its domain, its path on the phone, its size and flags
Manifest.plist	Properties of the backup as a whole, including whether it is encrypted and, if so, the key material
Info.plist	Device description: model, name, iOS version, phone number, last backup date
Status.plist	How the transfer ended, including a SnapshotState field

Everything else is either a two character folder name or a forty character file name.

Why is nothing inside called sms.db?

Because Apple renames every file to the SHA1 of its domain and its path on the device, joined with a hyphen. The real names exist only inside the index, which is why searching the folder for “sms.db” finds nothing at all.

The messages database lives at Library/SMS/sms.db in HomeDomain, so its name in the backup is the SHA1 of the string HomeDomain-Library/SMS/sms.db, which is:

3d0d7e5fb2ce288813306e4d4636395e047a3d28

That value is the same in every iTunes-style backup ever made, on every device, which is why it turns up in every article on this subject. You can search for it in the backup folder and you will find the file.

Since iOS 10 the files are sharded into 256 subfolders named after the first two characters of the hash, so the messages database is at 3d\3d0d7e5fb2ce288813306e4d4636395e047a3d28. Older backups keep everything flat in the device folder. Some backups additionally place the whole tree under a Snapshot subfolder. Anything reading a backup has to check all of these rather than assuming one.

Two details that cost people an afternoon:

• Attachments switch domain, and their paths need trimming. Inside the database, attachment paths start with the on-device home shorthand ~/, as in ~/Library/SMS/Attachments/ab/11/GUID/IMG_1.heic. Two things change before hashing: the ~/ prefix comes off, and the domain is MediaDomain, not the HomeDomain the database itself lives in. The name in the backup is the SHA1 of MediaDomain-Library/SMS/Attachments/ab/11/GUID/IMG_1.heic. Hash the string as written, or keep HomeDomain, and you get a name that is not in the backup.
• A missing file is normal. If the lookup finds nothing, the usual explanation is that the file was never backed up, which is common for attachments the user had already deleted on the phone. The database row survives, so you can still tell what was sent and when, without the image.

What is Manifest.db, and why do you want it?

Manifest.db is an ordinary SQLite database listing every file in the backup with its domain and its original path. It is the index that turns “I want the messages database” into “open this forty character file”, without anyone having to know the SHA1 rule.

It is also the fastest way to see what a backup actually contains. If a file you expect is not listed there, it is not in the backup, and no amount of searching the folder will produce it.

On an encrypted backup, Manifest.db is itself encrypted, which is why an encrypted backup shows you nothing at all until the password is supplied.

How do you tell a finished backup from an abandoned one?

Status.plist has a SnapshotState field, and when a backup has completed it reads finished. Useful, but on its own it is not enough. That flag has been observed being written at the start of a resumed transfer, minutes before any data landed, which means a folder can claim to be finished while it is still filling up.

The check that holds up in practice is to combine the flag with the presence of a file that arrives late in the transfer. The messages database is a good choice for exactly that reason. A folder whose SnapshotState says finished and which contains 3d\3d0d7e5fb2ce288813306e4d4636395e047a3d28 is a backup you can open. One that satisfies only the first is a backup that is still being written, and opening it produces a confusing “database missing or corrupted” error that has nothing to do with the database.

If you are looking at a backup that is mid-flight, the fix is not a tool. It is to leave the phone connected until it finishes.

How to check yours, in two minutes

1. Paste %USERPROFILE%\Apple\MobileSync\Backup into File Explorer. If it does not exist, try %APPDATA%\Apple Computer\MobileSync\Backup. If neither exists, no backup has ever been made on this PC.
2. Note how many device folders there are. More than one means more than one device, or one device backed up by both programs.
3. Open a device folder. Sort by date to see when it was last written.
4. Open Info.plist in Notepad. It is XML, and near the top it names the device and its iOS version, which is how you confirm you are looking at the right phone.
5. Look for a folder named 3d and check that it contains a file starting 3d0d7e5f. If it does, the messages database made it into this backup.

What does this not tell you?

The layout above is the same whether or not the backup is encrypted, but an encrypted backup gives up nothing without its password: Manifest.db and every file in it are encrypted, and there is no way around that by anyone, Apple included. That is a separate subject, covered in reading an encrypted iPhone backup on Windows.

And knowing where the file is is not the same as being able to read it. sms.db is a SQLite database whose layout changed several times between iOS 11 and today, and the message text is not always in the column you would expect. That is the subject of the full guide to exporting iPhone messages to PDF.