Practical Mobile Forensics - Fourth Edition

Device interaction

There is an SQLite database that records how the user interacts with different applications. This database is called interactionC.db and is located at /HomeDomain/Library/CoreDuet/People. The ZINTERACTIONS table contains information about whether the user reads a message, sends a message, performs a call, and so on. You can extract this information from the table with the query shown in the following screenshot:

Examining interactions in DB4S

Also, make sure you examined the ZCONTACTS table—it contains information about contacts who were involved in the user's interactions with the device, if applicable.