← All artifacts

FaceTime

FaceTime and phone call history including call records, group participants, and FaceTime Links for shareable meeting URLs.

Status
available
CLI plugin
facetime.apple
Categories
communication, user

Overview

The FaceTime collector captures call history from the CallHistory database, which records both FaceTime and traditional phone calls. It distinguishes call types (audio, video, phone) and service providers (FaceTime vs Telephony), and captures group call participant information. FaceTime Links — shareable meeting URLs — are collected from a separate database.

Analysis Tips

  • Call type identification: ZCALLTYPE values distinguish phone (1), FaceTime video (8), and FaceTime audio (16) calls
  • Service provider: ZSERVICE_PROVIDER differentiates com.apple.FaceTime from com.apple.Telephony
  • Group calls: Participant handles are linked via the Z_2REMOTEPARTICIPANTHANDLES join table
  • FaceTime Links: ZCONVERSATIONLINK records contain creation dates, expiry, and originator information
  • Duration analysis: Call duration combined with timestamps enables communication pattern analysis

Core Data Timestamps

FaceTime uses Core Data timestamps (seconds since 2001-01-01 00:00:00 UTC):

Core Data timestamp = Unix timestamp - 978307200

Related Artifacts

  • Contacts - Call participants map to contact records
  • Messages - Communication patterns across messaging and calls
  • Pattern of Life - InteractionC tracks cross-app communication

References

Data sources

CallHistory.storedataSQLite (Core Data)

~/Library/Application Support/CallHistoryDB/

All call records including FaceTime and phone calls

FaceTime.sqlite3SQLite

~/Library/Application Support/FaceTime/

FaceTime Links (shareable meeting URLs) with creation and expiry dates

com.apple.FaceTime.plistBinary Plist

~/Library/Preferences/

FaceTime application preferences