01Location
- /data/data/com.android.providers.contacts/databases/calllog.db
- /data/user_de/<userId>/com.android.providers.contacts/databases/calllog_shadow.db (shadow instance in device-encrypted storage)
- /data/data/com.samsung.android.providers.contacts/databases/calllog.db (Samsung)
- Legacy: calls table inside …/com.android.providers.contacts/databases/contacts2.db
02Questions it answers
- Which numbers were called or called the device, and when?
- Was a call answered, missed, rejected, blocked or sent to voicemail, and how long did it last?
- Which SIM or calling account handled the call?
- Was the call flagged as video, Wi-Fi, VoLTE or RTT?
03Format and versions
| Format | SQLite database created by CallLogDatabaseHelper (DATABASE_NAME "calllog.db"); one row per call in the calls table, with columns defined by CallLog.Calls. A second, "shadow" instance (calllog_shadow.db) is opened through a device-protected storage context. |
|---|---|
| Applies to | AOSP ContactsProvider. The calls and voicemail_status tables used to be in contacts2.db; current code migrates them into calllog.db when the new database is created. Call types 5–6 were added in API 24 and type 7 in API 25. |
04Key fields
| Field | What it tells you |
|---|---|
| number | The phone number as the user entered it. |
| type | 1 incoming, 2 outgoing, 3 missed, 4 voicemail, 5 rejected, 6 blocked, 7 answered externally. |
| duration | Duration of the call in seconds. |
| phone_account_component_name / phone_account_id | Component and identifier of the account used to place or receive the call. |
| geocoded_location / countryiso | A geocoded location for the number and the ISO country code where the call was made or received. |
| new / is_read | Whether the call has been acknowledged and whether the item was read or otherwise consumed. |
| features | Bit mask, e.g. video, Wi-Fi, VoLTE, VoNR, RTT, HD, pulled externally. |
| last_modified | When the row was last inserted, updated or marked as deleted. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| date | Unix epoch, milliseconds | The date the call occurred. |
| last_modified | Unix epoch, milliseconds | Row maintenance time, not call time; it can change when a row is updated or marked deleted. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Collect calllog.db with its -wal/-journal files, any calllog_shadow.db and, on older images, contacts2.db.
- Decode type, features and presentation values against the CallLog.Calls constants; keep the raw value beside each label.
- Convert date to UTC and derive the end time as date plus duration, marking it as computed.
- Compare the main and shadow databases and the last_modified values for rows that differ.
- Correlate numbers with contacts, SMS and app-level call records.
07Interpretation pitfalls
- geocoded_location describes the number, not the device position.
- ALEAPP applies the AOSP type codes to the Samsung provider too; whether Samsung stores other values is not established.
- Changes may sit in the -wal file; deleted rows may persist in free pages unless secure_delete or VACUUM removed them.
09Sources
- CallLog.Calls — API reference Android Developers · checked 2026-10-14
- AOSP — CallLogDatabaseHelper.java Android Open Source Project (GitHub mirror) · checked 2026-10-14
- ALEAPP — scripts/artifacts/calllog.py Alexis Brignoni et al. (GitHub) · checked 2026-10-14
- Support Direct Boot mode Android Developers · checked 2026-10-14
- SQLite — Write-Ahead Logging SQLite · checked 2026-10-14
- SQLite — PRAGMA statements (secure_delete) SQLite · checked 2026-10-14