Voicemail Database (voicemail.db)

Location

Description

SQLite database indexing visual voicemail messages received on the device. Each record contains the caller number, voicemail duration, receipt timestamp, playback status (read/unread), and a reference to the associated AMR audio file stored in the Voicemail/ directory. Transcription text from iOS voicemail-to-text is also stored when available.

Forensic Value

Voicemail records provide evidence of attempted communications even when calls were not answered, establishing that a specific number attempted contact at a given time. The associated audio files contain the actual voice recordings which may contain threats, instructions, or other evidentiary content. Voicemail transcriptions generated by iOS Siri provide searchable text versions of audio messages. Deleted voicemail database entries and orphaned audio files in the Voicemail directory can be recovered to reveal communications the user attempted to hide.

Tools Required

Collection Commands

idevicebackup2 backup --full /forensics/ios_backup/

python3 ileapp.py -t tar -i /path/to/backup -o /forensics/output/

python3 meat.py -i -o /forensics/output/ -t backup

Collection Constraints

• •Availability depends on iOS version, device lock state, backup class, and extraction method. Many protected domains require a full filesystem extraction or sysdiagnose rather than a standard backup.
• •Mobile application data may be partially cached, excluded from backup, or pruned by the OS. Validate against the extraction type before treating gaps as meaningful.

MITRE ATT&CK Techniques

References