01Location
- /private/var/mobile/Library/CallHistoryDB/CallHistory.storedata (+ -wal, -shm)
- /private/var/mobile/Library/CallHistoryDB/CallHistoryTemp.storedata
- /private/var/mobile/Library/CallHistoryDB/call_history.db (older format)
02Questions it answers
- Which numbers or handles called or were called, and when?
- Was the call incoming or outgoing, answered or not?
- Was it a phone call, FaceTime call or a third-party app call?
03Format and versions
| Format | Core Data SQLite store; calls in ZCALLRECORD. The older call_history.db format uses a call table with a flags bit field. |
|---|---|
| Applies to | iLEAPP reads both storedata files and the old format; an iOS 26.5 store added ZAUTOANSWEREDREASON, ZCOMMUNICATIONTRUSTSCORE, ZORIGINATINGDEVICENAME and ZBLOCKEDBYEXTENSIONNAME. |
04Key fields
| Field | What it tells you |
|---|---|
| ZADDRESS | Other party's number or handle. |
| ZORIGINATED / ZANSWERED | 0 incoming / 1 outgoing; answered flag. |
| ZCALLTYPE | iLEAPP labels 0, 1, 8, 16 as third-party app, phone, FaceTime video, FaceTime audio; no source confirms these labels. |
| ZSERVICE_PROVIDER | Calling service, e.g. a third-party app identifier such as WhatsApp. |
| ZDISCONNECTED_CAUSE | Disconnect cause as stored; iLEAPP labels are unconfirmed. |
| ZISO_COUNTRY_CODE / ZLOCATION | Country code and location string as stored. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| ZDATE | Apple Cocoa time (seconds since 2001-01-01 UTC) | Call start; add 978,307,200 for Unix seconds. |
| ZDURATION | Seconds (float) | End time = ZDATE + ZDURATION is computed, not stored. |
| call.date (old format) | Unix epoch, seconds | iLEAPP converts the legacy table with unixepoch. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Collect both storedata files with WAL/SHM; report rows from each with their source file.
- Convert ZDATE from the 2001 epoch and compute end times explicitly.
- Keep raw ZCALLTYPE and ZDISCONNECTED_CAUSE values beside any label.
- For third-party providers, compare with the app's own call records.
07Interpretation pitfalls
- Type and disconnect-cause labels are not vendor-documented.
- Rows may exist in both CallHistory.storedata and CallHistoryTemp.storedata; de-duplicate carefully.
- Recent records may be only in the -wal file.
09Sources
- iLEAPP — scripts/artifacts/callHistory.py Alexis Brignoni et al. (GitHub) · checked 2026-10-14
- CFAbsoluteTime Apple Developer Documentation · checked 2026-10-14
- SQLite — Write-Ahead Logging SQLite · checked 2026-10-14