Practical Mobile Forensics - Fourth Edition

Address book images

In addition to the address book's data, each contact may contain an image associated with it. This image is displayed on the screen whenever the user receives an incoming call from a particular contact. These images can be created by third-party applications that have access to the contacts on the device. Often, the contact is linked to a third-party application profile photo. The address book images database can be found at /HomeDomain/Library/AddressBook/AddressBookImages.sqlitedb.

The address book images can be parsed manually, but using commercial software makes this process much more practical. Most free and commercial tools will provide access to the address book images. However, some tools will not make the link ...