Call History Forensics: Who Called Whom and When

The call log is one of the most quietly powerful artifacts on a phone because it is hard to dispute. A message can be claimed out of context, but a call record is a plain fact: a number, a time, a duration and a direction. In cases from harassment to fraud to contact-order violations, the pattern of who called whom and when is frequently the spine the rest of the evidence hangs on. Sherlock Forensics iPhone Analyzer reconstructs that log into one searchable view, so an examiner reads the whole calling picture in one place.

For each call Sherlock shows the number or the resolved contact, the start time, the duration and the direction as incoming, outgoing, missed or blocked, together with the call type. The call type matters because a modern iPhone log is not only cellular. FaceTime audio and video calls sit in the same record. Many third-party calling apps register their calls through the iOS call system, so those call events appear in the unified log as well. What surfaces there is call-log metadata, the fact, timing and direction of a call, rather than the content of any conversation, a distinction the page states plainly.

Read across the merged Activity Timeline, the call log stops being a flat list. A call reads in sequence with the messages, locations and app activity around it, so a missed call before a sudden location change or a long call before a message thread becomes part of a chronology rather than an isolated row. Global search pulls every call to or from a number across the whole device at once, which is how a pattern of contact is established quickly.

The iPhone call log is carried inside an encrypted backup, so it does not require a full-filesystem extraction to reach. Sherlock reconstructs the call view from a backup you make over USB from a device you can unlock and Trust, from an existing iTunes or Finder backup or from a Cellebrite UFED or VeraKey full-filesystem extraction. Whichever way the evidence arrived, the call record is available, which makes the call log one of the most consistently present high-value artifacts in an iPhone case.

A full-filesystem extraction adds surrounding behavioral depth that a logical backup does not carry, but the call log itself comes through a backup in full. That accessibility is part of why the call log is so often the first artifact an examiner reaches for: it is present, it is structured and it establishes contact patterns without enterprise acquisition tooling.

Clearing the recent-calls list is a common reflex, so what survives that deletion is often the question a case turns on. The honest answer is the same physics that governs every SQLite artifact. When a call is deleted, iOS marks the record's database page as free rather than erasing it on the spot. Until the database writes new data over that page the deleted call is still physically present, so Sherlock carves those records back out through standard freed-page carving.

What survives therefore depends on time and device use after the deletion. A call cleared shortly before acquisition on a lightly used phone is often recoverable; a call cleared weeks ago on a heavily used device has usually been overwritten and no tool brings it back. Sherlock flags every carved call as recovered in the interface and the report, so an examiner can state on the record which calls were live and which were carved and can explain the survival logic without overclaiming. This is the same freed-page methodology every credible tool works under; the value is honest labeling, not a promised recovery number.

Call evidence carries weight precisely because it is simple and verifiable, so the documentation matches it: the court-ready HTML report carries case and evidence numbers, examiner identification, disclosed methodology, per-artifact SHA-256 hashing and an optional evidence-integrity manifest, with recovered calls flagged throughout, the documentation elements described in NIST Special Publication 800-101 Revision 1, Guidelines on Mobile Device Forensics. Analysis is 100 percent read-only; the evidence is never modified.

Built by CISSP, ISSAP and ISSMP certified examiners with 20 years of court-defensible practice. Admissibility depends on jurisdiction, authority and evidence handling; the report documents the record so testimony rests on it rather than on recollection.

Sherlock reads the call log from evidence you can lawfully acquire: a device you can unlock, an existing backup or a full-filesystem extraction produced by acquisition tooling. It does not unlock a locked device, does not bypass a passcode and does not obtain a carrier's call detail records or any server-side log through a provider. It reports the on-device call record, which is a different source from a carrier subpoena and is described as such. Calls deleted long enough ago to be overwritten are gone. Sherlock reports what the acquired evidence carries and flags what it recovered, which is what an examiner can defend on the stand.

Download the free edition, open a backup or extraction and read the call log yourself. Unlock the full record and carved calls when the case calls for it: $599 one-time, no subscription.

Get Sherlock Forensics iPhone Analyzer

Related: iMessage forensics · iPhone full-filesystem analysis · The full parser list · Product page