In addition to the address book's data, each contact may contain an image associated with it. This image is displayed on the screen whenever the user receives an incoming call from a particular contact. These images can be created by third-party applications that have access to the contacts on the device. Often, the contact is linked to a third-party application profile photo. The address book images database can be found at /HomeDomain/Library/AddressBook/AddressBookImages.sqlitedb.

The address book images can be parsed manually, but using commercial software makes this process much more practical. Most free and commercial tools will provide access to the address book images. However, some tools will not make the link between the graphic and the contact, which may require some manual rebuilding. Sometimes, the free solutions work best when parsing simple data from iOS devices. Next, we will examine the address book images in iExplorer, which was introduced in Chapter 4, Data Acquisition from iOS Backups.

In the example in the following screenshot, iExplorer matched contact data with the image automatically:

The same thumbnails can be found in the ABThumbnailImage table, in the data column. You can match the photo to the contact manually, using the record_id column from the ABThumbnailImage table of AddressBookImages.sqlitedb and the ROWID column from the ABPerson table of AddressBook.sqlitedb.