iOS Data Analysis and Recovery - Practical Mobile Forensics - page 157

Library/Mail/Protected Index . The database file has no extension and con-
tains locally stored, sent, and deleted messages.
You can run the following commands to obtain e-mails stored in the mail database:
$ sqlite3 Protected\ Index
SQLite version 3.7.12 2012-04-03 19:43:07
Enter ".help" for instructions
Enter SQL statements terminated with a ";"
sqlite>.output Email.csv
sqlite>.headers on
sqlite> SELECT * FROM messages;
sqlite>.exit
In addition to the messages, e-mail attachments are also often stored on the file system
within the Mail directory.
Notes
The Notes database contains the notes created by the user using the device's built-in
Notes application. Notes is the simplest application, often containing the most sensitive
and confidential information. The Notes database is a HomeDomain file and can be
found at /private/var/mobile/Library/Notes/notes.sqlite .
The Znote and Znotebody tables in the notes.sqlite file contain the notes title,
content, creation date, modification date, and more. You can run the following commands
to dump the Notes database into a CSV file named notes.csv :
$sqlite3 notes.sqlite
SQLite version 3.7.12 2012-04-03 19:43:07
Enter ".help" for instructions
Enter SQL statements terminated with a ";"
sqlite>.mode csv
sqlite>.output notes.csv
sqlite>.headers on
sqlite> SELECT
datetime(zcreationdate+978307200,'unixepoch') as
zcreationdate,
datetime(zmodificationdate+978307200,'unixepoch') as