Skip to Main Content
iPhone Forensics
book

iPhone Forensics

by Jonathan Zdziarski
September 2008
Intermediate to advanced content levelIntermediate to advanced
140 pages
3h 31m
English
O'Reilly Media, Inc.
Content preview from iPhone Forensics

Important Database Files

The following SQLite databases are present on the iPhone, and may be of interest depending on the needs of the case.

Note

These files exist on the media partition, which is mounted at /private/var on the iPhone. The pathnames provided here are based on your local desktop mount of the disk image, and therefore will not include /private/var in the path.

Address Book Contacts

The address book contains individual contact entries for all of the contacts stored on the iPhone. The address book database can be found at /mobile/Library/AddressBook/AddressBook.sqlitedb. The following tables are primarily used:

ABPerson

Contains the name, organization, department, and other general information about each contact.

ABRecent

Contains a record of recent changes to properties in the contact database and a timestamp of when each was made.

ABMultiValue

Contains multivalue data for each contact, including phone numbers, email addresses, website URLs, and other data for which the contact may have more than one. The table uses a record_id field to associate the contact information with a rowid from the ABPerson table. To query all of the multivalue information for a particular contact, use two queries: one to find the contact you’re looking for, and one to find their multivalue data:

sqlite> select ROWID, First Last, Organization, Department, JobTitle,
CreationDate, ModificationDate from ABPerson where First = 'Jonathan'; ROWID|Last|Organization|Department|JobTitle|CreationDate| ModificationDate ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Start your free trial

You might also like

iPhone and iOS Forensics

iPhone and iOS Forensics

Andrew Hoog, Katie Strzempka

Publisher Resources

ISBN: 9780596153588Supplemental ContentErrata Page