Coverage Reference

The iPhone Parser List: 130+ Artifact Views by Evidence Group

The first question an examiner asks of any tool is "does it parse what my case turns on." Here is the coverage map, grouped the way the tool groups it, with the source each view reads from.

Sherlock Forensics iPhone Analyzer ships 130+ dedicated artifact views across communications, media, web and location, personal, apps and system, acquisition integrity and the deep full-filesystem groups added in 1.2.0. Classic views populate from any backup or extraction; behavioral views populate from Cellebrite UFED or VeraKey full-filesystem depth. The free edition shows coverage against your own evidence.

Check Coverage Free Forensic Edition $599

Windows 10/11 | One-time license | Free edition previews every view

Read Me First

How to Read This List

Every entry below is a dedicated view in the tool: searchable, sortable, exportable to CSV or JSON and feeding one merged timeline and one global search. The Source column is the honesty layer: Any means the view populates from a logical MobileBackup2 backup as well as a full-filesystem extraction; Encrypted backup means iOS only includes that data when the backup is encrypted; FFS means the data lives in the behavioral layer that only a Cellebrite UFED or VeraKey full-filesystem extraction carries. A view whose source your evidence cannot contain shows an honest empty state rather than fabricated data.

The list is representative by group, not exhaustive; the tool's own sidebar with its per-view item-count badges is the authoritative inventory. The free edition shows it against your actual evidence.

Core Groups

Communications, Media, Web and Device

Group	Representative views	Source
Communications	Messages (SMS and iMessage), threaded Conversations, WhatsApp messages and Groups with members and admins and JIDs, Message Attachments, Call History, Voicemail, Contacts	Any
Media	Photos and videos with capture GPS, HEIC decode and HEVC playback, Favorites and Hidden and Recently-Deleted and Geotagged filters, Media Library, Voice Memos	Any
Web and Location	Safari history, Web Searches, Web Domains, Shared Links, Safari Tabs, Bookmarks, Cookies, Downloads, Wi-Fi networks with saved passwords, Bluetooth devices paired vs seen, Locations on an offline map, Location Access, Weather saved locations including the device owner HOME address	Any; Wi-Fi passwords need an encrypted backup
Personal	Notes with password-protected flagging, Reminders, Calendar, Health and Activity, Focus and Do Not Disturb modes, Alarms, Keyboard Lexicon	Any; Health needs an encrypted backup
Apps and System	Installed Apps, App Inventory, App State, App Permissions (TCC), Network Usage, SIM and Cellular identity, Home Screen layout revealing apps hidden in folders, Device Settings, Accounts, Keychain, Provisioning Profiles	Any; Keychain needs an encrypted backup
Acquisition and Integrity	Overview dashboard, Device Summary, Backup Info, Provenance, Acquisition Integrity, File Manifest with hashes and SQLite table browser, Extraction Provenance for ingested full-filesystem images	Any; Extraction Provenance is FFS
Correlation	Activity Timeline, Findings automated triage, Pattern of Life, Communication Map, Communication Insights, Contact Activity, Unknown Contacts, Deleted and Hidden recovery, Global search, Keyword-watchlist search, Anti-forensic app detection	Any; depth grows with the source

1.2.0 Deep Groups

The Full-Filesystem Groups

Group	Representative views	Source
Pattern of Life	Screen Time usage with daily totals, powerlog app usage, app install and uninstall history with versions, launch-by-launch app sequence, app intents, Siri actions and analytics, Focus and Do Not Disturb timeline, Handoff user-activity, App Store activity, on-device intelligence signals	FFS
Whereabouts	Significant locations with dwell times and enter and exit transitions, Apple Maps history, Find My devices and AirTags and family sharing, location permission requests, Waze destinations, named place-visit life events	FFS
Messaging Recovery	Skype, Facebook Messenger, Google Chat, LINE, imo, MeWe, Gettr, MEGA Chat, Instagram DMs, TikTok DMs, Discord and Reddit chat from on-device web caches; delivered-notification previews that survive in-app deletion	FFS; labeled as web-cache and notification-preview recovery
Expanded Media	Hidden and deleted photos, screenshots, photo albums, per-photo camera make and model, edited photos, Apple Podcasts, music and media library, Now Playing history	FFS depth
Health and Fitness	Workouts with GPS routes, heart-rate history, Fitbit GPS tracks and heart rate	FFS depth
Contacts Intelligence	Contact frequency, significant contacts, ID-status lookups, on-device intelligence entities and activity	FFS
Apps, Accessories and Web	Bluetooth and BLE device history, Snapchat memories, Stocks watchlist, AirDrop and sharing history, Clock app, cross-app cached-web-request view	FFS

These groups shipped in version 1.2.0 alongside Cellebrite UFED and VeraKey full-filesystem ingestion, more than fifty new views in one release, validated against the Josh Hickman iOS 17.3 public reference image, the standard DFIR test image. They are the reason a full-filesystem extraction is worth analyzing properly: the behavioral layer answers when, where and how the device was used, not only what was said.

Composition

Why the Count Matters Less Than the Composition

A parser count is a proxy; what decides cases is how the views compose. Every dated event from every view above merges into one Activity Timeline, filterable across every artifact source, so a Screen Time session, a message thread and a location transition read as one sequence rather than three exports. The Findings view runs automated first-look triage across the whole set: emergency calls, recovered deleted content, privacy-sensitive permission grants, hidden-vault apps, blocked callers, home location and device attribution surface without an examiner hunting view by view. Communication Map, Communication Insights, Contact Activity and Unknown Contacts turn the messaging and call views into relationship evidence, including handles the subject messaged but never saved.

Global search and keyword-watchlist search run one query across every view at once, per-view filters narrow by date range and item flagging rolls anything an examiner marks straight into the court report. The practical effect is that the 130+ views behave as one investigative surface, which is what an examiner is actually buying.

Deleted Data

Recovery and Carving Across the Set

Deleted messages, calls and contacts are carved from freed SQLite database pages wherever the freelist has not overwritten them, flagged as recovered in the interface and the report so live records and carved records never blur on the stand. Recently Deleted and Hidden media surface from any source that contains them; hidden and deleted photos at full-filesystem depth extend that reach. Recovery is always subject to survival: records already overwritten are gone. Sherlock reports what it found rather than promising universal recovery.

Verify It Yourself

Check Coverage Against Your Own Case, Free

A parser list on a web page is a claim; the sidebar against your own evidence is proof. The free edition loads your backup or your extracted UFED or VeraKey tree and shows every view with an item-count badge: a number means counted items, zero means counted and empty and a blank badge means the node is not a counted list, so a count is never a fabricated zero. Preview the first 25 percent of each view, capped at 100 rows and know before buying whether the views your case turns on are populated.

When they are, the Forensic Edition unlocks the complete data set, global and keyword-watchlist search, CSV and JSON export and the court-ready HTML report with an optional SHA-256 evidence-integrity manifest, the documentation elements described in NIST Special Publication 800-101 Revision 1, Guidelines on Mobile Device Forensics: $599 one-time, no subscription.

Questions

Parser Coverage FAQ

How many parsers does Sherlock Forensics iPhone Analyzer have?

130+ dedicated artifact views, with more than fifty added in version 1.2.0 alongside full-filesystem extraction support. Every view is searchable and exportable and feeds one merged timeline and one global search. The in-app sidebar is the authoritative inventory; the free edition shows the complete list with per-view item counts against your own evidence.

Does the parser list depend on the evidence source?

The views are always present; what populates them depends on the source. A logical MobileBackup2 backup populates the surface layer: messages, media, web, personal data and the keychain when the backup is encrypted. A Cellebrite UFED or VeraKey full-filesystem extraction additionally populates the deep behavioral groups: pattern of life, significant locations with dwell times, web-cache messaging recovery and notification previews. Views a source cannot contain show honest empty states.

Which messaging apps can Sherlock recover from an iPhone?

From any encrypted backup or extraction: iMessage and SMS as threaded conversations and WhatsApp messages and groups. From full-filesystem depth: chat recovered from on-device web caches for Skype, Facebook Messenger, Google Chat, LINE, imo, MeWe, Gettr, MEGA Chat, Instagram direct messages, TikTok direct messages, Discord and Reddit, with delivered-notification previews that survive in-app deletion. The web-cache recoveries are labeled as cache and preview content, not full message-database extractions.

Does Sherlock parse pattern-of-life artifacts?

Yes, from full-filesystem depth: Screen Time app usage with daily totals, power-log app usage, app install and uninstall history with versions, the launch-by-launch app sequence, app intents, Siri actions and analytics and the Focus and Do Not Disturb timeline, alongside a dedicated Pattern of Life correlation view.

Can I verify coverage for my specific case before buying?

Yes. The free edition loads your evidence and shows every view with item counts, previewing the first 25 percent of each view capped at 100 rows. You see exactly which parsers populate against your specific backup or extraction before spending anything.

Is this list exhaustive?

No, it is representative by group. The authoritative inventory is the tool's own sidebar, which carries item-count badges per view. The groups and named views on this page are drawn from the shipped 1.2.0 release.

Start Now

Prove the Coverage on Your Evidence

Download the free edition, load the case in front of you and read the sidebar. If the views your matter turns on are populated, the full seat is $599 one-time, no subscription.

Get Sherlock Forensics iPhone Analyzer