Contacts Forensics: The Map of a Network

The contacts list is quietly one of the most useful artifacts in an examination because it is the key that unlocks everything else. A call log full of bare numbers becomes a picture of relationships once each number resolves to a name. The address book is what does the resolving. Sherlock Forensics iPhone Analyzer reconstructs the whole book into a searchable view: each contact with names, multiple phone numbers, emails, physical addresses, organization, job title, notes, birthdays, related names and instant-messaging handles where they are present.

What lifts contacts above a simple list is how the fields join the rest of the device. A number in the address book is the same number in the call history and the messages, so a contact ties a name to the activity around it. The notes field on a contact often carries more than a name, an account detail, a nickname or a private annotation. The related-names field can map a family or an organization. Read across the merged timeline and global search, the address book turns loose numbers into a network of identified people and the traffic between them.

Deleting a contact is rarely accidental. It is a deliberate act. In an investigation it is often an attempt to sever a documented link to a person or a number. That is exactly why the deleted address book can be more revealing than the live one. The physics is the same as every other SQLite artifact: when a contact is deleted, iOS marks its database page free rather than erasing it, so Sherlock carves the record back out through freed-page carving until new data overwrites it.

What survives depends on time and device use after the deletion. A contact removed shortly before acquisition on a lightly used phone is often recoverable; one removed long ago on a busy device has usually been overwritten and no tool brings it back. Sherlock flags every carved contact as recovered in the interface and the report, distinct from the live book, so an examiner can state which contacts were present and which were carved. A carved contact that matches a number appearing in calls or messages is powerful corroboration that a subject knew someone they later tried to remove.

The address book is carried inside an encrypted iPhone backup, so contacts do not require a full-filesystem extraction to reach. Sherlock reconstructs the book from a backup you make over USB from a device you can unlock and Trust, from an existing iTunes or Finder backup or from a Cellebrite UFED or VeraKey full-filesystem extraction. Whichever way the evidence arrived, the contacts are available, which makes the address book one of the most consistently present artifacts in an iPhone case.

A full-filesystem extraction adds surrounding depth that a logical backup does not carry, but the contacts record itself comes through a backup in full, carved deleted entries included where the freelist retained them. An examiner does not need enterprise acquisition tooling to resolve the numbers in a case to names.

Because contacts anchor identity across the rest of the evidence, they belong in the record precisely: the court-ready HTML report carries case and evidence numbers, examiner identification, disclosed methodology, per-artifact SHA-256 hashing and an optional evidence-integrity manifest, with recovered contacts flagged throughout, the documentation practice set out in NIST Special Publication 800-101 Revision 1, Guidelines on Mobile Device Forensics. Analysis is 100 percent read-only; the evidence is never modified.

Built by CISSP, ISSAP and ISSMP certified examiners with 20 years of court-defensible practice. Admissibility depends on jurisdiction, authority and evidence handling; the report documents the record so testimony rests on it rather than on recollection.

Sherlock reads the address book from evidence you can lawfully acquire: a device you can unlock, an existing backup or a full-filesystem extraction produced by acquisition tooling. It does not unlock a locked device and does not bypass a passcode. A contact record shows a stored name and details, not proof of who used them; attribution to a person is weighed with the rest of the record. Contacts deleted long enough ago to be overwritten are gone. Sherlock reports what the acquired evidence carries and flags what it recovered, which is what an examiner can defend on the stand.

Download the free edition, open a backup or extraction and read the address book yourself. Unlock the full analysis and carved contacts when the case calls for it: $599 one-time, no subscription.

Get Sherlock Forensics iPhone Analyzer

Related: iMessage forensics · Read a Cellebrite UFED extraction · The full parser list · Product page