Skip to content

Commit 8a4af4c

Browse files
kacos2000kacos2000
authored
IOS
1 parent e334cf7 commit 8a4af4c

6 files changed

+373
-0
lines changed

‎Photos_sqlite.sql

+129
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
-- References:
2+
--
3+
-- https://github.com/geiszla/iOSLib/wiki/ZGENERICASSET-contents
4+
-- https://github.com/geiszla/iOSLib/wiki/ZADDITIONALASSETATTRIBUTES-contents
5+
-- https://forensenellanebbia.blogspot.com/2015/10/apple-ios-recently-deleted-images.html
6+
7+
select
8+
Z_PRIMARYKEY.Z_NAME as 'Type',
9+
case zgenericasset.ZSAVEDASSETTYPE
10+
when 0 then 'Saved from other source'
11+
when 2 then 'Photo Streams Data'
12+
when 3 then 'Made/saved with this device'
13+
when 4 then 'Default row'
14+
when 7 then 'Deleted'
15+
else zgenericasset.ZSAVEDASSETTYPE
16+
end as 'AssetType',
17+
ZDIRECTORY as 'Directory',
18+
ZFILENAME as 'FileName',
19+
ZADDITIONALASSETATTRIBUTES.ZORIGINALFILENAME as 'OriginalFilename',
20+
ZADDITIONALASSETATTRIBUTES.ZORIGINALFILESIZE as 'OriginalSize',
21+
ZUNIFORMTYPEIDENTIFIER as 'FormTypeIdentifier',
22+
ZIMAGEURLDATA as 'ImageURLdata',
23+
ZTHUMBNAILURLDATA as 'ThumbnailURLdata',
24+
case ZCLOUDDOWNLOADREQUESTS
25+
when 0 then 'No'
26+
when 1 then 'Yes'
27+
end as 'CLOUDDOWNLOADREQUESTS',
28+
case ZCLOUDISDELETABLE
29+
when 1 then 'Yes'
30+
end as 'CLOUDISDELETABLE',
31+
case ZCLOUDISMYASSET
32+
when 1 then 'Yes'
33+
end as 'CLOUDISMYASSET',
34+
case ZCLOUDLOCALSTATE
35+
when 0 then 'Local'
36+
when 1 then 'Remote'
37+
end as 'CLOUDLOCALSTATE',
38+
case ZFAVORITE
39+
when 0 then 'No'
40+
when 1 then 'Yes'
41+
end as 'Favorite',
42+
case ZHASADJUSTMENTS
43+
when 0 then 'No'
44+
when 1 then 'Yes'
45+
end as 'Modified',
46+
ZWIDTH||' x '||ZHEIGHT as 'Dimenasions(WxH)',
47+
ZADDITIONALASSETATTRIBUTES.ZEMBEDDEDTHUMBNAILWIDTH||' x '||ZADDITIONALASSETATTRIBUTES.ZEMBEDDEDTHUMBNAILHEIGHT as 'EmbeddedThumbnail(WxH)',
48+
ZADDITIONALASSETATTRIBUTES.ZEMBEDDEDTHUMBNAILOFFSET as 'EmbeddedThumbnailOffset',
49+
ZADDITIONALASSETATTRIBUTES.ZEMBEDDEDTHUMBNAILLENGTH as 'ETNLength',
50+
time(ZDURATION,'unixepoch') as 'Duration',
51+
case ZORIENTATION
52+
when 1 then 'Horizontal (left)'
53+
when 3 then 'Horizontal (right)'
54+
when 6 then 'Vertical (up)'
55+
when 8 then 'Vertical (down)'
56+
else ZORIENTATION
57+
end as 'Orientation',
58+
case ZKIND
59+
when 0 then 'Photo'
60+
when 1 then 'Video'
61+
end as 'Kind',
62+
case ZKINDSUBTYPE
63+
when 0 then 'Normal'
64+
when 1 then 'Panorama'
65+
when 100 then 'Default row'
66+
when 101 then 'Slo-mo'
67+
when 102 then 'Timelapse'
68+
else ZKINDSUBTYPE
69+
end as 'SubType',
70+
case zgenericasset.ZHIGHDYNAMICRANGETYPE
71+
when 0 then 'No HDR'
72+
when 1 then 'Low'
73+
when 6 then 'High'
74+
else zgenericasset.ZHIGHDYNAMICRANGETYPE
75+
end as 'HDRtype', --Seen values 0, 1 and 6
76+
case zgenericasset.ZTRASHEDSTATE
77+
when 1 then 'Deleted'
78+
when 0 then 'Not Deleted'
79+
else zgenericasset.ZTRASHEDSTATE
80+
end as 'TrashState',
81+
datetime('2001-01-01', ZTRASHEDDATE || ' seconds') as 'TrashedDate',
82+
case ZCOMPLETE
83+
when 1 then 'Yes'
84+
end as 'Complete',
85+
case ZVISIBILITYSTATE
86+
when 0 then 'Visible'
87+
when 1 then 'Photo Streams Data'
88+
when 2 then 'Burst'
89+
else ZVISIBILITYSTATE
90+
end as 'VisibilityState',
91+
ZADDITIONALASSETATTRIBUTES.ZCREATORBUNDLEID as 'CreatorBundleID',
92+
ZADDITIONALASSETATTRIBUTES.ZEDITORBUNDLEID as 'EditorBundleID',
93+
ZUNMANAGEDADJUSTMENT.ZADJUSTMENTFORMATIDENTIFIER||' ('||ZUNMANAGEDADJUSTMENT.ZADJUSTMENTFORMATVERSION||')' as 'AdjustmentFormatIdentifier',
94+
datetime('2001-01-01', ZUNMANAGEDADJUSTMENT.ZADJUSTMENTTIMESTAMP || ' seconds') as 'AdjustmentTimestamp',
95+
datetime('2001-01-01', ZMODIFICATIONDATE || ' seconds') as 'ModificationDate',
96+
datetime('2001-01-01', ZADDEDDATE || ' seconds') as 'AddedDate',
97+
datetime('2001-01-01', ZDATECREATED || ' seconds') as 'CreatedDate',
98+
ZADDITIONALASSETATTRIBUTES.ZEXIFTIMESTAMPSTRING as 'EXIFtimestamp',
99+
datetime('2001-01-01', ZMOMENT.ZSTARTDATE || ' seconds') as 'MomentStartDate',
100+
datetime('2001-01-01', ZMOMENT.ZENDDATE || ' seconds') as 'MomentEndDate',
101+
datetime('2001-01-01', zgenericasset.ZLASTSHAREDDATE || ' seconds') as 'LastSharedDate',
102+
ZADDITIONALASSETATTRIBUTES.ZTIMEZONENAME||' ('||ZADDITIONALASSETATTRIBUTES.ZTIMEZONEOFFSET||')' as 'TimeZone',
103+
ZMOMENT.ZAPPROXIMATELOCATIONDATA as 'ApproximateLocationData(bplist)',
104+
ZMOMENT.ZREVERSELOCATIONDATA as 'ReverseLocationData0(bplist)',
105+
case ZMOMENT.ZREVERSELOCATIONDATAISVALID
106+
when 0 then 'No'
107+
when 1 then 'Yes'
108+
end as 'LocationValid',
109+
ZMOMENTLIST.ZREVERSELOCATIONDATA as 'ReverseLocationData1(bplist)',
110+
case ZMOMENTLIST.ZREVERSELOCATIONDATAISVALID
111+
when 0 then 'No'
112+
when 1 then 'Yes'
113+
end as 'LocationValid',
114+
ZADDITIONALASSETATTRIBUTES.ZREVERSELOCATIONDATA as 'ReverseLocationData2(bplist)'
115+
116+
-- case ZADDITIONALASSETATTRIBUTES.ZSHIFTEDLOCATIONISVALID -- Field does not exist in IOS 8.3
117+
-- when 0 then 'No'
118+
-- when 1 then 'Yes'
119+
-- end as 'ShiftedLocationValid'
120+
121+
122+
from zgenericasset
123+
join Z_PRIMARYKEY on zgenericasset.z_ent = Z_PRIMARYKEY.z_ent
124+
left join ZMOMENTLIST on zgenericasset.ZMOMENT = ZMOMENTLIST.Z_PK
125+
left join ZMOMENT on ZGENERICASSET."ZMOMENT" = ZMOMENT.Z_PK
126+
join ZADDITIONALASSETATTRIBUTES on ZGENERICASSET.ZADDITIONALATTRIBUTES = ZADDITIONALASSETATTRIBUTES.Z_PK
127+
left join ZUNMANAGEDADJUSTMENT on ZADDITIONALASSETATTRIBUTES."ZUNMANAGEDADJUSTMENT" = ZUNMANAGEDADJUSTMENT.Z_PK
128+
order by MomentStartDate desc
129+

‎callhistory_storedata.sql

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
-- IOS 8 \Home\Library\CallHistoryDB
2+
-- References:
3+
--
4+
-- https://avi.alkalay.net/2011/12/iphone-call-history.html
5+
-- https://books.google.gr/books?id=HodcDgAAQBAJ&pg=PA224&lpg=PA224&dq=zcalltype&source=bl&ots=AxN5C2eH2m&sig=ACfU3U0rLvkJ-gU-3HS9siXl54LrysrW4w&hl=en&sa=X&ved=2ahUKEwiE3p7O9e3iAhVBr6QKHT6LDTkQ6AEwEXoECAkQAQ#v=onepage&q=zcalltype&f=false
6+
7+
select
8+
9+
z_pk as 'zpk',
10+
ZISO_COUNTRY_CODE as 'CC',
11+
ZADDRESS as 'Address',
12+
ZNAME as 'Name',
13+
ZNUMBER_AVAILABILITY as 'Nr_Availability',
14+
case ZORIGINATED
15+
when 1 then 'Yes'
16+
end as 'Originated',
17+
case ZANSWERED
18+
when 0 then 'No'
19+
when 1 then 'Yes'
20+
end as 'Answered',
21+
case ZREAD
22+
when 0 then 'No'
23+
when 1 then 'Yes'
24+
end as 'Read',
25+
ZDISCONNECTED_CAUSE as'DisconnectedCause',
26+
case ZCALLTYPE --
27+
when 1 then 'Standard Call'
28+
when 8 then 'Full AV Facetime Call'
29+
when 16 then 'Facetime Audio only Call'
30+
else ZCALLTYPE
31+
end as 'CallType',
32+
ZFACE_TIME_DATA as 'FacetimeData',
33+
time(ZDURATION,'unixepoch') as 'Duration',
34+
datetime('2001-01-01', zdate || ' seconds') as 'cdate',
35+
ZDEVICE_ID as 'DeviceID',
36+
ZUNIQUE_ID as 'UniqueID'
37+
38+
from zcallrecord
39+
--where ZCALLTYPE = 8 filter by call type
40+
order by cdate desc

‎healthdb.sql

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
select
2+
-- iPhone 7 (9.3.1)
3+
4+
sources.name,
5+
case datatype_source_order.data_type -- https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1528385073.pdf
6+
when 3 then 'Weight'
7+
when 5 then 'Heart Rate'
8+
when 7 then 'Steps'
9+
when 8 then 'Distance'
10+
when 9 then 'Resting Energy'
11+
when 10 then 'Active Energy'
12+
when 12 then 'Flights Climbed'
13+
when 67 then 'Weekly Calorie Goal'
14+
when 70 then 'Watch On'
15+
when 75 then 'Standing'
16+
when 76 then 'Activity'
17+
when 79 then 'Workout'
18+
when 83 then 'Some workouts'
19+
else datatype_source_order.data_type -- 20’s ~ 30’s = Nutrition
20+
end as 'DataType',
21+
subscription_data_anchors.last_anchor,
22+
datatype_source_order.ROWID,
23+
datatype_source_order.user_preferred,
24+
datatype_source_order.provenance
25+
26+
from datatype_source_order
27+
join sources on datatype_source_order.source = sources.ROWID
28+
join subscription_data_anchors on subscription_data_anchors.code = datatype_source_order.data_type

‎healthdb_secure.sql

+41
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
-- iPhone 7 (9.3.1)
2+
-- references:
3+
--
4+
-- ref: https://www.mac4n6.com/?offset=1544965200340
5+
-- https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1528385073.pdf
6+
-- https://objectivebythesea.com/v1/talks/OBTS_v1_Edwards.pdf
7+
8+
select --
9+
category_samples.value,
10+
data_provenances.origin_device||' - '||data_provenances.origin_build as 'Device',
11+
case samples.data_type
12+
when 3 then 'Weight'
13+
when 5 then 'Heart Rate'
14+
when 7 then 'Steps'
15+
when 8 then 'Distance'
16+
when 9 then 'Resting Energy'
17+
when 10 then 'Active Energy'
18+
when 12 then 'Flights Climbed'
19+
when 67 then 'Weekly Calorie Goal'
20+
when 70 then 'Watch On'
21+
when 75 then 'Standing'
22+
when 76 then 'Activity'
23+
when 79 then 'Workout'
24+
when 83 then 'Some workouts'
25+
else samples.data_type -- 20’s ~ 30’s = Nutrition
26+
end as 'DataType',
27+
quantity_samples.original_quantity||' '||unit_strings.unit_string as 'originalquantity',
28+
quantity_samples.quantity as 'quantity',
29+
datetime('2001-01-01', samples.start_date || ' seconds') as 'StartDate',
30+
datetime('2001-01-01', samples.end_date || ' seconds') as 'EndDate'
31+
32+
from samples
33+
left join activity_caches on activity_caches.data_id = samples.data_id
34+
left join quantity_samples on quantity_samples.data_id = samples.data_id
35+
left join correlations on samples.data_id = correlations.object
36+
left join data_provenances on data_provenances.ROWID = quantity_samples.original_unit
37+
left join category_samples on category_samples.data_id = samples.data_id
38+
left join unit_strings on unit_strings.ROWID = quantity_samples.original_unit
39+
40+
--where data_type = 5 -- filter by heart rate
41+
order by StartDate desc

‎iPhotoLitedb.sql

+47
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
--IOS 9.3.1 (iphoto)
2+
--\Camera Roll\Media\PhotoData\iPhotoSandboxLibrary\438665323315681\Database\iPhotoLite.db
3+
4+
select
5+
BLDBAlbum.uuid as 'AlbumUUID', -- Foldername
6+
BLDBAlbumMediaJoin.type, -- value can also be seen in the Album.plist in the above folders
7+
BLDBAlbum.name||' ('||BLDBAlbum.itemCount||')' as 'AlbumName(count)',
8+
case BLDBAlbum.state
9+
when 1 then 'Exists' end as 'AlbumState',
10+
case bldbmedia.state
11+
when 0 then 'Deleted'
12+
end as 'MediaState',
13+
bldbmedia.uuid 'Media UUID',
14+
bldbmedia.fileName,
15+
bldbmedia.fileSize,
16+
bldbmedia.type as 'imageType',
17+
time(bldbmedia.duration,'unixepoch') as 'Duration',
18+
bldbmedia.latitude,
19+
bldbmedia.longitude,
20+
datetime('2001-01-01',bldbmedia.DateCreated || ' seconds') as 'DateCreated',
21+
case when bldbmedia.dateViewed != 0.0 then datetime('2001-01-01',bldbmedia.dateViewed || ' seconds') end as 'DateViewed',
22+
case when bldbmedia.dateAdjusted then datetime('2001-01-01',bldbmedia.dateAdjusted || ' seconds') end as 'DateAdjusted',
23+
case when bldbmedia.dateModified then datetime('2001-01-01',bldbmedia.dateModified || ' seconds') end as 'DateModified',
24+
bldbmedia.PixelWidth||' x '||bldbmedia.PixelHeight as 'Dimensions (WxH)',
25+
bldbmedia.assetPixelWidth||' x '||bldbmedia.assetPixelHeight as 'assetDimensions',
26+
bldbmedia.originalPixelWidth||' x '||bldbmedia.originalPixelHeight as 'originalDimensions',
27+
case bldbmedia.assetOrientation
28+
when 1 then 'Horizontal (left)'
29+
when 3 then 'Horizontal (right)'
30+
when 6 then 'Vertical (up)'
31+
when 8 then 'Vertical (down)'
32+
else bldbmedia.assetOrientation
33+
end as 'AssetOrientation',
34+
case bldbmedia.originalOrientation
35+
when 1 then 'Horizontal (left)'
36+
when 3 then 'Horizontal (right)'
37+
when 6 then 'Vertical (up)'
38+
when 8 then 'Vertical (down)'
39+
else bldbmedia.originalOrientation
40+
end as 'OriginalOrientation'
41+
42+
43+
from bldbmedia
44+
join BLDBAlbumMediaJoin on BLDBMedia.primaryKey = BLDBAlbumMediaJoin.mediaKey
45+
join BLDBAlbum on BLDBAlbumMediaJoin.albumKey = BLDBAlbum.primaryKey
46+
47+
order by DateCreated desc

‎sms_db.sql

+88
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
select
2+
-- \Library\SMS\sms.db
3+
4+
case when message."date" != 0 then datetime('2001-01-01', message."date" || ' seconds') end as 'MessageDate',
5+
case when message.date_delivered != 0 then datetime('2001-01-01', message.date_delivered || ' seconds') end as 'DateDelivered',
6+
case when message.date_read != 0 then datetime('2001-01-01', message.date_read || ' seconds') end as 'DateRead',
7+
case when message.date_played != 0 then datetime('2001-01-01', message.date_played || ' seconds') end as 'DatePlayed',
8+
handle.country,
9+
handle.id,
10+
message.handle_id as 'handleID',
11+
message.other_handle as 'OtherID',
12+
handle.service,
13+
chat.account_login,
14+
case message.is_from_me
15+
when 1 then 'Yes'
16+
end as 'FromME',
17+
case message.is_from_me
18+
when 1 then message.text
19+
end as 'MyText',
20+
case message.is_from_me
21+
when 0 then message.text
22+
end as 'RemoteText',
23+
message.attributedBody as 'attributedBody(BLOB)',
24+
chat.display_name,
25+
case message.cache_has_attachments
26+
when 1 then 'yes'
27+
end as 'CacheHasAttachments',
28+
case attachment.is_outgoing
29+
when 0 then 'Incoming'
30+
when 1 then 'Outgoing'
31+
end as 'AttachmentDirection',
32+
attachment.filename,
33+
attachment.transfer_name,
34+
attachment.total_bytes,
35+
attachment.mime_type,
36+
datetime('2001-01-01', attachment.created_date|| ' seconds') as 'CreatedDate',
37+
attachment.uti,
38+
attachment.transfer_state, -- observed values 5 (temp folder) & 6 (Library)
39+
attachment.user_info as 'AttachmentUserInfo(bplist)',
40+
chat.room_name,
41+
chat.chat_identifier,
42+
chat.last_addressed_handle,
43+
case message.is_delivered
44+
when 0 then 'No'
45+
when 1 then 'yes'
46+
end as 'is_delivered',
47+
case message.was_data_detected
48+
when 1 then 'yes'
49+
end as 'was_data_detected',
50+
message.item_type,
51+
52+
case message.is_empty
53+
when 1 then 'yes'
54+
end as 'is_empty',
55+
case message.is_archive
56+
when 1 then 'yes'
57+
end as 'is_archive',
58+
case message.is_finished
59+
when 1 then 'yes'
60+
end as 'is_finished',
61+
case message.is_audio_message
62+
when 1 then 'yes'
63+
end as 'is_audio_message',
64+
case message.is_delayed
65+
when 1 then 'yes'
66+
end as 'is_delayed',
67+
case message.is_emote
68+
when 1 then 'yes'
69+
end as 'is_emote',
70+
71+
chat.properties as 'ChatProperties(bplist)',
72+
message.guid as 'MessageGUID',
73+
chat.account_id,
74+
chat.group_id
75+
76+
77+
78+
79+
from message
80+
left join handle on message.handle_id = handle.ROWID or message.other_handle = handle.ROWID
81+
join chat_message_join on chat_message_join.message_id = message.ROWID
82+
left join message_attachment_join on message.ROWID = message_attachment_join.message_id --A message can have multiple attachments
83+
left join attachment on attachment.ROWID = message_attachment_join.attachment_id
84+
join chat on chat_message_join.chat_id = chat.ROWID
85+
86+
87+
88+
order by message.ROWID desc

0 commit comments

Comments
 (0)