Practical Mobile Forensics - Third Edition

Calendar events

Calendar events that have been manually created by the user or synced using a mail application or other third-party applications are stored in the calendar database. The calendar database is a HomeDomain file and can be found at /private/var/mobile/Library/Calendar/Calendar.sqlitedb.

The CalendarItem table in the Calendar.sqlitedb file contains the calendar events summary, description, start date, end date, and more. You can run the following queries in the DB Browser for SQLite to parse the calendar:

Examining calendar.sqlitedb in the DB Browser for SQLite