Voicemail Database (voicemail.db)

iosCommunicationDevice Extraction

Location

HomeDomain/Library/Voicemail/voicemail.db

Description

SQLite database indexing visual voicemail messages received on the device. Each record contains the caller number, voicemail duration, receipt timestamp, playback status (read/unread), and a reference to the associated AMR audio file stored in the Voicemail/ directory. Transcription text from iOS voicemail-to-text is also stored when available.

Forensic Value

Voicemail records provide evidence of attempted communications even when calls were not answered, establishing that a specific number attempted contact at a given time. The associated audio files contain the actual voice recordings which may contain threats, instructions, or other evidentiary content. Voicemail transcriptions generated by iOS Siri provide searchable text versions of audio messages. Deleted voicemail database entries and orphaned audio files in the Voicemail directory can be recovered to reveal communications the user attempted to hide.

Tools Required

Cellebrite UFEDiLEAPPMagnet AXIOMBelkasoftDB Browser for SQLite