Another location that stores applications that have been used, deleted, or even reinstalled on the iOS device is DataUsage.sqlite, which is located at /var/wireless/Library/Databases/Datausage.sqlite. This database is accessible in most forensic images and backups and is located in Library/databases. When examining this database, we can see one primary table of interest is ZPROCESS. All other tables should be examined for relevance to your investigation. In ZPROCESS, we can see the first time the app was launched, as well as the last time the app was launched and used. The Bundle name represents the application installer. Below is a sample query that extracts key data from this table.

Select ZPROCESS.Z_PK,

  DateTime(ZFIRSTTIMESTAMP + 978307200, 'UNIXEPOCH') AS

  "First Timestamp",

  DateTime(ZTIMESTAMP + 978307200, 'UNIXEPOCH') AS "Last Timestamp",

  ZBUNDLENAME,

  ZPROCNAME

From ZPROCESS