The address book contains a wealth of information about the owner's personal contacts. With the exception of third-party applications, the address book contains contact entries for all of the contacts that are stored on the device. The address book database can be found at /HomeDomain/Library/AddressBook.sqlitedb. The AddressBook.sqlitedb file contains several tables, of which the following three are of particular interest:

• ABPerson: This contains the name, organization, notes, and more for each contact.
• ABMultiValue: This contains phone numbers, email addresses, website Uniform Resource Locators (URLs), and more for the entries in the ABPerson table. The ABMultiValue table uses a record_id file to associate the contact information with a ROWID from the ABPerson table.
• ABMultiValueLabel: This table contains labels to identify the kind of information stored in the ABMultiValue table.

Some of the data stored within the AddressBook.sqlitedb file could be from third-party applications. You should manually examine the application file folders to ensure that all the contacts are accounted for and examined.

While all the following commands can be run natively on a Mac, we are going to use DB4S to examine the most common databases found on iOS devices. This is a free tool that simplifies the process and provides a clear view of the data to you. Once the database is loaded, you can draft queries to examine the data most relevant to you and export the address book into a .csv file named AddressBook.csv, as shown in the following screenshot:

In the preceding screenshot, you can see the suggested query to parse data from both the ABPerson and ABMultiValue tables.