Practical Mobile Forensics - Fourth Edition

Extracting call history

Call history data can currently be extracted from the Phone file. It's important to note that the file doesn't have an extension and is located at \Users\WPCOMMSERVICES\APPDATA\ Local\UserData\. Here is an example of a Windows 10 Phone file:

The Phone file in a Windows Phone

In a similar manner, we will be extracting internet history in the following section.