Lecture 12: Case study 2: iOS Forensics

Question 1

What can we find in iOs?

Answer 1

• Contacts: Addressbook.sqlite
• Call History: call_history.db
• Chats: ChatStorage.sqlite
• Calendar: Calendar.sqlitedb/Extras.db
• SMS: sms.db
• Location: consolidated.db
• notes.sqlite
• photos.sqlite
• voicemail.db

Question 2

How to recover contact information?

Answer 2

1. Examine the schema of ABPerson table
2. Retrieve all information from the ABPerson
3. Examine the schema of other tables– ABMultiValue, ABMultiValueEntry, ABRecent, …
4. Retrieve information from the ABPerson,
   ABMultivalue, ABMultiValueEntry,
   ABMultiValueLabel tables

Question 3

Retrieving Call History Information

Answer 3

call_history.db (changed to: Callhistory.storedata)
important table = call (ZCALLRECORD)

Question 4

Retrieve type of call

Answer 4

• 4: incoming
  – 5: outgoing
  – 8: blocked
  – 16: Facetime

ZORIGINATED = 0 THEN Incoming
ZORIGINATED = 1 THEN Outgoing

Question 5

Retrieve sms info

Answer 5

sms.db
Important tables : message, sqlite_sequence, msg_group, group_member, msg_pieces