Is phone call history available on OS X?
I found my history at:
~/Library/Application Support/CallHistoryDB/CallHistory.storedata
if you want to be able to decode the destination phone/facetime numbers stored in storedata
, there are currently two solutions available:
- Original solution in Python
- Faster Golang implementation based on the original solution
Both allow to decrypt the addressee number, but the latter is available as executable files for different platforms.
Just a follow up to @Pukeko answer; I wanted to decode the ZADDRESS field in my Objective-C app. It took me a while to work out, so thought I'd share the code in case it helps someone else.
Based on https://github.com/n0fate/OS-X-Continuity as linked by Pukeko
I included this: https://github.com/indisoluble/AesGcm in my project
NSString *base64Key = @""; //Password found in Keychain for "Call History User Data Key"
NSData *key = [[NSData alloc] initWithBase64EncodedString:base64Key options:0];
NSData *iv = [zAddr subdataWithRange:NSMakeRange(0x10, 0x10)];
NSData *data = [zAddr subdataWithRange:NSMakeRange(0x20, zAddr.length - 0x20)];
NSData *tag = [zAddr subdataWithRange:NSMakeRange(0, 0x10)];
IAGCipheredData *cipheredData = [[IAGCipheredData alloc] initWithCipheredData:data authenticationTag:tag];
NSData *plainData = [IAGAesGcm plainDataByAuthenticatedDecryptingCipheredData:cipheredData
withAdditionalAuthenticatedData:[NSData data]
initializationVector:iv
key:key
error:nil];
return [[NSString alloc] initWithData:plainData encoding:NSUTF8StringEncoding];