Call logs, contacts, and messages--
we want to take a look at how this data's stored,
so let's start actually with contacts.
The AddressBook.sqlitedb has been in play on Apple
since the beginning of time, and has been consistent.
When I tell you to compare any traces back
to AddressBook.sqlitedb, the reason I'm
doing that is because this file is
going to be on every single iPad and iPhone that you examine.
It is consistent.
It's always in the same path.
You only have one table of interest.
It's ABPerson.
Now, are these the only contacts that you're going to have?
Absolutely not, because all the third-party apps
may store contacts within them.
If the person has an image associated
to the contact in the address book,
you'll see that under AddressBookImages.sqlitedb.
Call logs-- this includes FaceTime.
We're going to see callhistory.storedata.
This is what you actually examined in lab 1.3
in section 1.
You wrote a query for this.
This file was introduced with iOS 8.
Now, the reason I'm mentioning this is,
if you have a legacy device-- iOS 7 backup or something you
find--
make sure you look for CallHistoryDB.
Leverage your cheat sheet on how to parse that.
The table of interest is zcallrecord.
What about people you block?
So think about this.
My friend asked me the other day--
he's like, I keep getting texts from this person.
And I was like, tell them to stop texting you,
and block their number.
If he followed my instructions and said, do not text me,
and then block their number, that block number goes
to comm.apple.cmfsyncagent.plist--
so all the people you block.