Investigating iOS Calls
12/01/2024 Friday
The call log is a record of incoming, outgoing, and missed calls on a device. These logs include essential details such as the contact's name or phone number, call type, date, time, and call duration. On Apple devices, such as iPhones, the iOS call log is synchronized across all linked Apple devices, and it also integrates FaceTime calls, both audio and video. It may also contain information about interactions with third-party calling apps. The iOS call log serves as a valuable tool for users to review their communication history and facilitate quick and convenient dialing.
Digital Forensics Value of iOS Calls
Digital forensics for iOS calls involve the meticulous analysis of call-related data on Apple devices, providing valuable insights for investigators. The call log serves as a historical record of incoming, outgoing, and missed calls, offering details such as contact information, call types, timestamps, and durations. Through forensic examination, experts can extract data from the call log, identify communication patterns of the device user.
Location of iOS Calls Artifacts
iOS Calls artifact can be found at the following location
/private/var/mobile/Library/CallHistoryDB/CallHistory.storedata
Analyzing iOS Calls Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract iOS Calls artifact from iOS device's files and what kind of digital forensics insights we can gain from the artifact.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select iOS Calls artifact:
×
Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of iOS Calls artifact in ArtiFast.
iOS Calls
- Call Type: The type of the call.
- Call Unique ID: The unique identifier of the call.
- Country Code: The country code where the call’s partner was when performing this call.
- Direction: The direction of the call whether it is incoming or outgoing.
- Duration: The duration of the call (in seconds).
- Is Answered: Indicates whether the call has been answered by the device user or not.
- Is Read: Indicates whether the call has been read by the device user or not.
- Partner Type: The call’s partner type.
- Partner's Phone Number: The call’s partner phone number.
- Partner's Location: The call’s partner location.
- Partner's Name: The call’s partner name.
- Service Provider: The call’s service provider.
- Disconnected Cause: The disconnected cause.
- Call Time: The date/time when this call has been performed.
For more information or suggestions please contact: kalthoum.karkazan@forensafe.com
