- Nationwide Digital Forensic & Cyber Services
- BOOK A FREE CONSULTATION TODAY!
Independent forensic analysis of iPhone call logs — cellular voice calls, FaceTime audio and video, VoIP (WhatsApp, Signal, Zoom) — plus the Address Book and every contact-interaction artifact used to prove communication between parties.
Quick Answer. iPhone call history is stored in CallHistory.storedata at /private/var/mobile/Library/CallHistoryDB/, a Core Data SQLite file. Each row records call type (cellular/FaceTime/VoIP), remote party, direction, timestamps, duration, and originating app bundle-id. Contacts live in AddressBook.sqlitedb. FaceTime and VoIP calls also generate KnowledgeC and Unified Log entries; app-specific VoIP logs (WhatsApp CallLog, Signal call table) provide corroboration.
| Column | Meaning |
|---|---|
| ZDATE | Call start (Core Data time) |
| ZDURATION | Duration in seconds (0 = missed) |
| ZADDRESS | Remote number or Apple ID |
| ZANSWERED / ZORIGINATED | Direction and answer state |
| ZCALLTYPE | 0=cellular, 1=FaceTime, 8=FaceTime audio, 16=third-party VoIP |
| ZSERVICE_PROVIDER | com.apple.telephony, com.apple.facetime, com.whatsapp, org.whispersystems.signal, … |
| ZFACE_TIME_DATA | FaceTime-specific metadata |
Every contact is stored in ABPerson with linked ABMultiValue rows for phone numbers, emails, addresses, social profiles. ABPerson.CreationDate and ABPerson.ModificationDate reveal when contacts were added or edited. Deleted contacts persist in the WAL and in prior backups; group-membership history is preserved in ABGroupMembership.
WhatsApp, Signal, Telegram, FaceTime, Zoom, and Teams register as CallKit providers. Every call they place surfaces in CallHistory.storedata and each app also keeps its own log:
CallHistory.sqlite in the WhatsApp containercall_records table in Signal.sqlitedb_sqlitecom.apple.facetime.bag plus Unified LogCorroborating the CallKit-visible entry against the app’s internal log is decisive.
Even after a user “Clears” call history, the WAL of CallHistory.storedata retains recent rows; SQLite freelist carving recovers older ones; prior iTunes/iCloud backups preserve pre-deletion state; and KnowledgeC / Biome record call durations independently as com.apple.mobilephone foreground sessions.
Elite Digital Forensics is an independent, defense-aligned iPhone forensics practice. We are retained by attorneys, in-house counsel, and, where appropriate, individuals and businesses directly. Every engagement begins with a scoped acquisition plan, hash-verified evidence, and a written report suitable for attorney review, negotiation, or court. When retained through counsel, our work product is protected. See the iPhone Forensics hub for the full analytical framework we bring to every matter.
Frequently, via WAL, SQLite carving, and prior backups. KnowledgeC also records call app usage independently.
Yes — iOS surfaces every CallKit-registered call in CallHistory.storedata with the originating bundle-id.
Yes, through the AddressBook.sqlitedb WAL and prior backups.
By cross-corroborating CallHistory ZDURATION with KnowledgeC /app/inFocus for the calling app and Unified Log CommCenter or CallKit events.
Tell us about the Mac, the accounts, and the timeframe. We will tell you what is recoverable, what is not, and what it will cost.
Request Confidential Consultation Call (833) 292-3733This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic services and expert witness testimony; we do not provide legal representation. Every case is fact-specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder