- Nationwide Digital Forensic & Cyber Services
- BOOK A FREE CONSULTATION TODAY!
Independent forensic analysis of the Android Contacts and CallLog providers — contacts2.db, call type/duration/timestamps, RCS/VoIP call metadata, blocked numbers, aggregated contact enrichment, and deleted-entry recovery.
Quick Answer. Android stores contacts and call history in the Contacts provider at /data/data/com.android.providers.contacts/databases/contacts2.db. Contacts live in raw_contacts and data; calls in calls. Each row carries phone number, call type (1=incoming/2=outgoing/3=missed/4=voicemail/5=rejected/6=blocked/7=answered_externally), duration in seconds, timestamps in ms since epoch, and features (video, HD, RCS, Wi-Fi calling). Deleted rows commonly persist in SQLite WAL and freelist pages, and cross-device sync from a Google account can restore contacts and call history that were locally deleted.
| Table | Contents | Forensic value |
|---|---|---|
| calls | _id, number, date, duration, type, features, geocoded_location, subscription_id, subscription_component_name, phone_account_address, block_reason, missed_reason | Complete call metadata including RCS/VoIP/carrier |
| raw_contacts | account_name, account_type, display_name, times_contacted, last_time_contacted, starred, sync flags | Per-account contact instances |
| data | raw_contact_id, mimetype, data1-data15 (varies by mimetype: phone/email/name/postal/photo/im/note/nickname/website/event/organization/relation) | Individual contact fields |
| contacts | name_raw_contact_id, photo_id, photo_file_id, times_contacted, last_time_contacted, in_visible_group | Aggregated contact-level view |
| deleted_contacts | contact_id, contact_deleted_timestamp | Tombstones for deleted aggregated contacts |
| agg_exceptions | raw_contact_id1, raw_contact_id2, type (1=together/2=separate) | Manual merge/unmerge decisions |
| groups | account_name, account_type, title, deleted | Contact groups incl. deleted |
The type column encodes call disposition. The features column is a bitmask: 0x01 video, 0x02 HD, 0x04 Wi-Fi, 0x10 RTT, 0x20 volte, 0x40 HD_CODEC. On dual-SIM devices, subscription_component_name and subscription_id identify which SIM/carrier handled the call, decisive when a matter turns on personal-vs-business line usage. block_reason and missed_reason (Android 10+) capture spam-filter decisions and network cause codes.
Not every call is a cellular call. Google Duo/Meet, WhatsApp, Signal, Telegram, Facebook Messenger, Discord, and Zoom keep their own call histories inside their app containers. WhatsApp’s msgstore.db has call_log. Signal keeps calls in signal.db (SQLCipher). Google Meet uses server-side call records. We aggregate all of them into a single unified call timeline.
contacts2.db-wal) — very often retains recently deleted calls.SyncState table shows per-account last-sync tokens.All Android timestamps are Java System.currentTimeMillis() — milliseconds since 1970-01-01 UTC. We convert every row to the device’s local time zone at the moment of the event using Android settings_global.xml, persist.sys.timezone, and logcat time-zone changes.
Elite Digital Forensics is an independent, defense-aligned Android forensics practice. We are retained by attorneys, in-house counsel, and, where appropriate, individuals and businesses directly. Every engagement begins with a scoped acquisition plan, hash-verified evidence, and a written report suitable for attorney review, negotiation, or court. When retained through counsel, our work product is protected. See the Android Forensics hub for the full analytical framework we bring to every matter.
By default the CallLog provider retains 500 rows per account. Google Voice, carrier records, and vendor-specific logs (Samsung “S Call”) extend this significantly. Prior backups extend it further.
Yes — WhatsApp records every call attempt in msgstore.db call_log with participant IDs, duration, and video flag. Content is not stored, but metadata is decisive.
Google Contacts moves deleted entries to a Trash retained for 30 days server-side. Local deletion often leaves the row in contacts2.db WAL for a period. Between the two, deleted contacts are frequently recoverable within the first month.
The CallLog records the number the carrier presented (CNAM/CLI). Cross-corroboration with carrier records, RCS/VoIP metadata, and location artifacts distinguishes spoofed from legitimate.
Tell us about the device, the accounts, and the timeframe. We will tell you what is recoverable, what is not, and what it will cost.
Request Confidential Consultation Call (833) 292-3733This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic services and expert witness testimony; we do not provide legal representation. Every case is fact-specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder