Practical Mobile Forensics - Third Edition

Address book contacts

The address book contains a wealth of information about the owner's personal contacts. With the exception of third-party applications, the address book contains contact entries for all of the contacts that are stored on the device. The address book database is a HomeDomain file, and it can be found at private/var/mobile/Library/AddressBook/AddressBook.sqlitedb. The AddressBook.sqlitedb file contains several tables, of which the following three are of particular interest:

• ABPerson: This contains the name, organization, notes, and more for each contact.
• ABMultiValue: This contains phone numbers, email addresses, website URLs, and more for the entries in the ABPerson table. The ABMultiValue table uses a record_id file ...