CHFI Mobile and Malware Forensics Practice Question
During an iOS forensic examination, an analyst extracts the iTunes backup of a suspect iPhone. The analyst wants to review deleted SMS messages. Which SQLite database file should be examined?
⚠ Common exam trap
EC-Council often tests the misconception that deleted SMS messages are stored in a separate 'deleted items' database or that call_history.db contains SMS data, leading candidates to overlook the primary SMS.db file.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SMS.db
In iOS forensics, deleted SMS messages are stored in the SMS.db SQLite database located within the iTunes backup. This database contains the `message` table, which retains deleted messages until overwritten by new data, making it the primary target for recovering deleted iMessages and SMS texts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AddressBook.db
Why it's wrong here
This database stores contacts, including names, phone numbers, emails, and related metadata, but does not contain SMS or iMessage message content. While it may reference phone numbers used in messaging, the actual message transactions, timestamps, and text bodies reside in SMS.db. Therefore, an analyst seeking message content should query SMS.db, not AddressBook.db.
- ✗
Keyboard.db
Why it's wrong here
This database records keyboard usage statistics and custom user dictionary entries (e.g., learned words, autocorrect replacements), not SMS messages. It is actually a SQLite database that contains the user's keyboard cache, including text snippets that have been typed, but it does not store the structured message history with senders, recipients, timestamps, and delivery statuses that SMS.db provides. Thus, it is not the correct source for message extraction.
- ✓
SMS.db
Why this is correct
This is the primary database in iOS that stores both SMS (via cellular) and iMessage (via Apple's push service) conversations. It contains tables such as 'message' and 'chat' that record the full message text, timestamps (in Apple's Core Data format), phone numbers/identifiers, and flags for read/delivered status. Even deleted messages can sometimes be recovered from unused or free pages within the SQLite file until those blocks are overwritten, making it the key artifact for forensic message analysis.
- ✗
call_history.db
Why it's wrong here
This database stores call logs, including phone numbers, call durations, start times, and call types (incoming, outgoing, missed), but it does not contain SMS or iMessage text content. While it may correlate with message timestamps, the actual message bodies and associated metadata are stored separately in SMS.db. Therefore, it is not the appropriate database for retrieving SMS messages.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 745 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.