iPhone Capture Tool (ICT)

**Overview: ** We want to develop an iPhone application that sends an email that contains all of the iPhone’s call history. We will refer to this application as the iPhone Capture Tool (ICT). ** Requirements: ** Occasionally, you must have access to a high speed connection so we can talk with you on Skype during our work day (GMT+5). ** ** ## Deliverables **Design notes:** 1) Application startup: The end user will launch the application from the iPhone desktop. Once started, a “progress dialog?? will show minimal status information, and finally close. 2) User Interface: The system will display the “progress dialog?? updating the dialog to show these steps: - Locating messages - Loading Phone Messages - Compressing messages - Sending messages - Finished The steps for loading phone messages are displayed only when new messages are found. The ??finished?? step will appear, the system will pause for 5 seconds and the dialog will disappear without the user confirmation. 3) Application installation: The application will be installable using the “adhoc helper?? technique described here <[login to view URL]> 4) Application first time startup: When the application is started for the first time, it will present a dialog box where the user can enter an email address. This is the email address where the phone call transcripts will be sent. This will only occur the first time the application is run. 5) Archiving process in detail: The main line of the application will look in the internal sqllite databases (built-in to the iphone) that contain the phone call history. This database information will be exported to a file. This file will be attached to an email message. The file name of the attachment will be phone_mm_dd_yyyy.txt. Where MM DD and YYYY are the day when the transcript was sent. The records in the attachment will be queried based on the following technique. The date range of the records will befor one (1) day before the last time the user started the application, to the current date. So, if the user ran the application on a Wednesday, and then on a Friday, the program would extract records for all of Tuesday, Wednesday, Thursday and Friday. This technique will generate an acceptable overlap in records for Tuesday and part of Wednesday. The attachment should contain all of the fields in the sqlite database. **Reference:** The book iPhone Forensics By Jonathan Zdziarski has a detailed discussion on the sqlite query techniques required to extract the information. Review page 78. <[login to view URL]> Look for the section titled “call history." This book shows that the database can be accessed using these commands: $sqlite3 [login to view URL] SQLite version 3.4.0 Enter “.help?? for instructions Sqlite> .headers on Sqlite> select * from call; ROWID|address|date|duration|flags|id 1|8005551212|1213024211|60|5|-1