Practical Mobile Forensics - Fourth Edition

Phone numbers

You can obtain information about all phone numbers utilized by the user, even if they changed phones and restored from a backup, by analyzing the CellularUsage.db file located at /WirelessDomain/Library/Databases. The query to extract this data is shown in the following screenshot:

Extracting phone numbers

As you can see, there is not only phone numbers available, but also the Subscriber Identity Module (SIM) card's Integrated Circuit Card Identifier (ICCID).