Added iMessage Support for MacOS

[Gear-I]

Adds four new artifacts parsing ~/Library/Messages/chat.db on macOS: Messages, Attachments, Chat Threads, and Deletion Tombstones.

Validated against a real chat.db from Josh Hickman's public macOS Big Sur test image (thisisdfir persona): 25 messages, 5 attachments, 1 chat thread, 1 handle — see sample_data on each artifact.

Notes:

• attributedBody (NSKeyedArchiver rich-text blob) is not decoded; rows where text is empty but attributedBody is present are flagged in the Body Source column rather than shown as empty.
• message.date/date_read/date_delivered use Mac Absolute Time in nanoseconds; attachment.created_date/start_date use seconds — confirmed against real data, documented in the module docstring."

Code was co-authored by Claude Sonnet 5

[abrignoni]

Thanks for the contribution!

This PR changes artifact modules without test data for them. A small fixture with each artifact change lets reviewers run the module against real data, and the committed case keeps guarding the module after merge.

• iMessageMessages.py: please include a fixture with this PR.

Adding a fixture

Generate it from your extraction with the helper (details in create_module_test_cases.md):

python admin/test/scripts/make_case_data.py <module> --case <case_number> --input <extraction.zip>

It writes admin/test/cases/testdata.<module>.json and one zip per artifact under admin/test/cases/data/<module>/.

Size rules:

• Under 10 MB per zip: commit the files in this PR.
• 10 to 25 MB: commit the case JSON in the PR and attach the zip to a comment here.
• Over 25 MB: say so here and a maintainer will arrange a handoff.

If your extraction cannot be shared:

• If the app appears on a public research image, generate the fixture from that instead. public_corpus_images.md lists the images and where to download them.
• Or sanitize the real file in place: keep the file the app wrote and overwrite only the personal values, which keeps the format honest.
• Or script a known session: install the app on a test device with a throwaway account, perform documented actions, and extract that.

If none of those fit, say so here and we will work it out. The PR can still be reviewed and merged with the gap recorded in the artifact's notes.

This is a request, not a gate. Nothing here blocks review.