Master iOS file system forensics. Learn to identify and analyze SQLite databases containing volatile and deleted communication artifacts on Apple devices.

CHFI (312-49) Digital Forensics Simulation

Investigation Scenario

You are conducting a digital forensics investigation on a suspect's iPhone 13 (iOS 16) involved in a corporate espionage case. The suspect allegedly transmitted confidential documents to a competitor via the native Apple Mail application and subsequently deleted the messages to destroy evidence. You have successfully performed a Full File System (FFS) extraction of the device and are now navigating the file system to locate remnants of the deleted communications.

Evidence Collected

Question

In a mobile-forensics investigation of an iPhone, an analyst is looking for evidence of deleted emails. Which of the following databases on the iOS file system stores email messages?

A. Envelope Index (within the Mail folder)
B. sms.db
C. CallHistory.storedata
D. com.apple.mobile.installation.plist
Investigator's Hint: Think about the terminology Apple uses for its native Mail application. The database acts as a container or "wrapper" that indexes the contents, metadata, and routing information of messages.

Expert Analysis

1. What the Evidence Shows: The FFS extraction grants access to the /private/var/mobile/Library/ directory, which houses the core databases for native iOS applications. Analyzing the SQLite databases within this directory is the standard procedure for extracting user communication data.
2. Forensic Stage: Examination and Analysis.
3. Why Correct (A): The Envelope Index is an SQLite database used by the native Apple Mail app to index and store email metadata and content snippets. When an email is "deleted" by the user, the record is often initially just marked as deleted. Its contents can frequently be recovered by carving the SQLite database's free pages (unallocated space) or by examining the Envelope Index-wal (Write-Ahead Log) file before the database executes a vacuum operation.
4. Why Others Are Wrong:
• Option B (sms.db): This database specifically stores SMS, MMS, and iMessage communications, not emails. It is located in the /Library/SMS/ directory.
• Option C (CallHistory.storedata): This database stores the call logs (incoming, outgoing, missed, FaceTime) and is located in the /Library/CallHistoryDB/ directory.
• Option D (com.apple.mobile.installation.plist): This is a Property List (plist) file, not a database. It contains metadata about applications installed on the iOS device, including their bundle identifiers and installation paths.
5. Real-World Action: An investigator will export the Envelope Index, Envelope Index-wal, and Envelope Index-shm files from the forensic image. Using a tool like DB Browser for SQLite or an automated suite like Cellebrite Physical Analyzer or Magnet AXIOM, they will query the messages and subjects tables. They will also run a SQLite carver against the file to extract orphaned records from deleted emails.

Mini Lesson: SQLite WAL Forensics

Modern iOS applications heavily rely on SQLite databases configured with Write-Ahead Logging (WAL). Understanding this is critical for recovering deleted evidence:

  • The Main Database (.db / no extension): Stores the committed data.
  • Write-Ahead Log (-wal): When a user deletes an email, the transaction is first written to the WAL file. The actual database is not immediately modified.

If an investigator only analyzes the main Envelope Index file and ignores the -wal file, they will likely miss the most recent transactions, including the records of emails the suspect attempted to destroy right before device seizure.

Ready for the next investigation?

Continue refining your mobile and digital forensics capabilities with our CHFI practice environments.

Explore More CHFI Simulations