Take advantage of “Integrated Calling” to know whom suspect talked to

A new feature in iOS 10 is “Integrated Calling”. An integrated call from Chat App like Naver LINE or Skype or FB Messenger can be answered directly from the lock screen and from the home screen when you receive it. On the iOS lock screen, you see the familiar ‘Slide to answer’ option for answering an in-coming call. On your home screen, you see the two Accept and Decline buttons you normally see for a network call.

This new feature is very convenient for users and also a very good news to forensic guys. It’s activated in default. Take a look at screenshots below and you will know what I mean. The Chat App voice call records showed up in the iPhone Call History!!!

Now we could know whom suspect talked to and how often the frequency is. Maybe you will say that suspect he/she could remove those records in Call History. Yes, definitely he/she could do so. Let’s remove those Chat App voice call records and take a look at Call History Database. Congratulations those Chat App voice call records are gone! In fact not that easy.

Fortunately forensic guys no need to worry about this because we still could find those deleted records in Call History Database. Those records still exists unless being overwritten by new data.