← All artifacts

Contacts

Apple Contacts (AddressBook) database containing contact records, group memberships, change tracking, and per-source account databases.

Status
available
CLI plugin
contacts.addressbook
Categories
communication, user

Overview

The Apple Contacts database stores all contact records including phone numbers, email addresses, postal addresses, social profiles, and associated metadata. The collector enumerates per-source databases (iCloud, Exchange, CardDAV) and captures change tracking records that reveal when contacts were added, modified, or deleted.

Analysis Tips

  • Contact resolution: Phone numbers and email addresses can be cross-referenced with Messages, FaceTime, and Mail
  • Change tracking: ATRANSACTION and ACHANGE tables record modification history with timestamps
  • Deleted contacts: ZABCDDELETEDRECORDLOG preserves records of removed contacts
  • Multi-source analysis: Per-source databases reveal which accounts sync which contacts
  • Photo evidence: Contact photos stored in _EXTERNAL_DATA directories may contain metadata

Core Data Timestamps

Contacts uses Core Data timestamps (seconds since 2001-01-01 00:00:00 UTC):

Core Data timestamp = Unix timestamp - 978307200

Related Artifacts

  • Messages - Message threads reference contact handles
  • FaceTime - Call history links to contact identifiers
  • Mail - Email addresses correlate with contact records

References

Data sources

AddressBook-v22.abcddbSQLite (Core Data)

~/Library/Application Support/AddressBook/

All contact records, groups, and relationships

AddressBook-v22.abcddbSQLite (Core Data)

~/Library/Application Support/AddressBook/Sources/{UUID}/

Per-account databases (iCloud, Exchange, CardDAV)

ABAssistantChangelog.aclcddbSQLite

~/Library/Application Support/AddressBook/

Siri and Suggestions change log

com.apple.AddressBook.plistBinary Plist

~/Library/Preferences/

Application preferences