Practical Mobile Forensics - Fourth Edition

Address book contacts

The address book contains a wealth of information about the owner's personal contacts. With the exception of third-party applications, the address book contains contact entries for all of the contacts that are stored on the device. The address book database can be found at /HomeDomain/Library/AddressBook.sqlitedb. The AddressBook.sqlitedb file contains several tables, of which the following three are of particular interest:

• ABPerson: This contains the name, organization, notes, and more for each contact.
• ABMultiValue: This contains phone numbers, email addresses, website Uniform Resource Locators (URLs), and more for the entries in the ABPerson table. The ABMultiValue table uses a record_id file to associate the contact ...