Windows Mobile 6.5 SMS Database File Structures

Windows Mobile 6.5 stores Short Message Service (SMS) history within proprietary, structured database volumes located in the root file system, primarily utilizing the Embedded Database (EDB) engine. This article details the specific file locations, underlying database architectures, and internal record structures responsible for indexing, storing, and organizing text messages on the Windows Mobile 6.5 operating system.

Primary Volume Files

SMS messages in Windows Mobile 6.5 are managed by the Messaging subsystem and stored inside mounted volume files (.vol) located at the root of the internal storage.

  • \cemail.vol: This is the primary database volume dedicated to the messaging store. It contains all folders, message metadata, message headers, and text payloads for SMS, MMS, and email accounts.
  • \pim.vol: While primarily the Personal Information Manager (PIM) database for contacts, tasks, and calendar entries, this volume works closely with cemail.vol. It holds recipient resolution data and contact records that correlate with the phone numbers stored in SMS headers.

Both files are continuously mounted by the operating system upon boot and locked by the system kernel (nk.exe) and messaging processes, preventing standard file-copy operations while the OS is running.

The EDB Database Engine Architecture

Windows Mobile 6.5 transitioned completely from the legacy CEDB (Compact Embedded Database) system to EDB (Embedded Database), a database engine derived from the desktop Windows Extensible Storage Engine (ESE / JET Blue).

The internal structure of an EDB file consists of:

  • Fixed Page Size: EDB files are structured around discrete pages, typically 4096 bytes (4 KB) in size.
  • Volume Header: The initial pages of cemail.vol contain the database header, volume metadata, schema definitions, and pointers to active database catalogs and transaction logs.
  • B+ Tree Indexing: EDB organizes records using B+ trees to enable high-speed querying across messaging folders. Indexes are maintained for fields such as Message ID, Date/Time Received, Folder ID (e.g., Inbox, Outbox, Sent, Deleted), and Read/Unread status.
  • Transaction Logging: EDB incorporates ACID-compliant transaction logging to prevent corruption during unexpected battery removal or system resets.

Internal Table and Record Layout

Inside cemail.vol, SMS history is arranged into tables modeled closely after the Messaging Application Programming Interface (MAPI) architecture:

  1. Folders Table: Maintains the hierarchy of message stores (e.g., SMS/MMS root, Inbox, Sent Items, Deleted Items, Drafts).
  2. Messages Table: Contains the individual message records. Each SMS is represented as an individual row or record containing predefined MAPI property tags:
    • Message Identification: Unique Entry IDs and conversation thread IDs.
    • Timestamps: 64-bit Windows FILETIME structures denoting delivery and transmission times.
    • Addressing: Originating and destination phone numbers formatted as string properties.
    • Flags: Bitmasks defining message state (e.g., read, unread, high priority, multipart status).
    • Body Payload: The textual body of the SMS. Short messages are stored as inline Unicode strings directly within the record page. Longer texts or segmented messages that exceed standard page boundaries are offloaded into linked stream pages.

Forensic extraction or parsing of Windows Mobile 6.5 SMS history requires tools capable of reading raw EDB page allocations or querying the system through ActiveSync/RAPI (Remote Application Programming Interface) to extract records without corrupting the active volume.