01Location
- /private/var/mobile/Library/AddressBook/AddressBook.sqlitedb
- /private/var/mobile/Library/AddressBook/AddressBookImages.sqlitedb
02Questions it answers
- Which names, numbers, emails and addresses were stored?
- When was a contact created or last modified?
- Which store (local or account) does a contact belong to?
03Format and versions
| Format | SQLite. ABPerson holds one row per contact; ABMultiValue holds multi-valued properties keyed by record_id and property, with labels in ABMultiValueLabel and structured parts in ABMultiValueEntry; ABStore names the store. Images are in ABThumbnailImage/ABFullSizeImage of the images database. |
|---|---|
| Applies to | iLEAPP test images span iOS 12.4 to iOS 18.7; property numbers follow the observed schema. |
04Key fields
| Field | What it tells you |
|---|---|
| ABPerson.First / Last / Organization / JobTitle | Name and organisation fields. |
| ABMultiValue.property | iLEAPP reads 3 phone, 4 email, 5 address, 13 instant message, 22 URL, 23 related name, 46 profile; no Apple source publishes these numbers. |
| ABMultiValueLabel.value | Label such as _$!<Mobile>!$_; strip the wrapper for display. |
| ABPerson.StoreID → ABStore.Name | Store that owns the contact. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| ABPerson.CreationDate | Apple Cocoa time (seconds since 2001-01-01 UTC) | Contact record creation. |
| ABPerson.ModificationDate | Apple Cocoa time | Last modification of the record. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Attach AddressBookImages.sqlitedb when reviewing photos.
- Group ABMultiValue rows per person and property, joining labels.
- Convert dates from the 2001 epoch.
- Use the result to label handles in Messages and call history.
07Interpretation pitfalls
- Property numbers are empirical; confirm them on the image under examination.
- Contacts synced from an account were not necessarily created on this device.
09Sources
- iLEAPP — scripts/artifacts/addressBook.py Alexis Brignoni et al. (GitHub) · checked 2026-10-14
- CFAbsoluteTime Apple Developer Documentation · checked 2026-10-14