iPhone Forensics

SQLite Databases

The iPhone makes heavy use of database files to store information such as address book contacts, SMS messages, email messages, and other data of a personal nature. This is done using the SQLite database software (version 3), which is an open source, public domain database package. SQLite databases typically have the file extension .sqlitedb, but some databases on the iPhone have the .db extension instead. In order to access the data stored in these files, you’ll need a tool that can read them. Good choices include:

• The SQLite command-line client, which can be downloaded at http://www.sqlite.org.

• SQLite Browser, a free, open source GUI tool for browsing SQLite databases. It is available at http://sqlitebrowser.sourceforge.net.

Mac OS X Leopard includes the SQLite command-line client, so we’ll use command-line examples here. SQLite’s command-line utility can easily access the individual files and issue SQL queries against a database.

Note

The basic commands you’ll need to learn will be explained in this chapter. For additional information about Structured Query Language (SQL), read Learning SQL by Alan Beaulieu (O’Reilly).

Connecting to a Database

To open a SQLite database from the command line, invoke the sqlite3 client. This will dump you to a SQL prompt where you can issue queries:

$ sqlite3 filename
SQLite version 3.4.0
Enter ".help" for instructions
sqlite>

You are now connected to the database file you’ve specified. To disconnect, use the .exit command; be sure to prefix ...