Communication data can be recovered from the /Library directory and is normally parsed by the mobile device forensic tools. Again, data marked for deletion may be parsed by some tools, but sometimes the data is overlooked and missed completely by the tool. The examiner must examine each database in question and then examine the data in Hex to ensure that nothing was overlooked. Free scripts are available to parse deleted data from the free pages of SQLite. Should more data be recovered, it should be carved and reported accordingly.  If data is missing from the SQLite database, one may have luck recovering deleted calls from: /Library/CallHistoryTransactions/<GUID>.log

Important files for Call History

  •  /private/var/mobile/Library/CallHistoryDB/CallHistory.storedata 

  •  /private/var/mobile/Library/CallHistoryTransactions/<GUID>.log

An example of the <GUID>.log is shown here.