Summary

In this chapter, we learned all about how iOS stores emails and messages on the device and what artifacts an investigator can expect to find.

First, we introduced the Apple Mail application and discovered where emails are stored. We analyzed the relevant SQLite databases to extract email metadata and learned how to parse through EML files to view the email's body.

Later in the chapter, we focused on messaging forensics by looking at how iOS stores SMS and iMessage data on the sms.db database and how a SQL query can be used to extract all messages and their metadata. Then, we introduced the topic of third-party messaging applications and focused on three of them: WhatsApp, Telegram, and Signal. We learned what data can be extracted from these apps and which are the most relevant SQL databases.

Finally, in the last section of this chapter, we discussed different options to attempt the recovery of deleted messages, such as using an open source tool called Mirf, which...