iOS Data Analysis and Recovery - Practical Mobile Forensics - page 156

Enter ".help" for instructions
Enter SQL statements terminated with a ";"
sqlite>.mode csv
sqlite>.output smsspotlightcache.csv
sqlite>.headers on
sqlite> SELECT * FROM Content;
sqlite>.exit
Calendar events
Calendar events that have been manually created by the user or synced using a mail ap-
plication or other third-party applications are stored in the calendar database. The calendar
database is a HomeDomain file and can be found at /private/var/mobile/
Library/Calendar/Calendar.sqlitedb .
The CalendarItem table in the Calendar.sqlitedb file contains the calendar
events summary, description, start date, end date, and more. You can run the following
command lines to dump the calendar database into a CSV file named calendar.csv .
Note that reminders and tasks are often saved in the Calendar.sqlitedb file. These
files may not contain a start or end time depending on the event:
$ sqlite3 Calendar.sqlitedb
SQLite version 3.7.12 2012-04-03 19:43:07
Enter ".help" for instructions
Enter SQL statements terminated with a ";"
sqlite>.mode csv
sqlite>.output calendar.csv
sqlite>.headers on
sqlite> SELECT
rowid,summary,description,datetime(start_date +
978307200,'unixepoch') as start_date,datetime (end_date +
978307200,'unixepoch') as end_date
FROM CalendarItem;
sqlite>.exit
E-mail database
All e-mail or mail applications on the device are stored in a SQLite database file. The
database is a HomeDomain file and can be found at /private/var/mobile/