Forum

I'm currently examining an iPhone and want to extract all Emails in the Email database Envelope Index.

I'm using the following sql query to extract all Email:

select rowid, sender, subject _to, cc, date_sent, date_received, mailbox, remote_mailbox, original_mailbox, read, deleted, data FROM messages, message_data where message_data.message_id = messages.ROWID;

I have experimented using different output .modes such as csv, html and so on but havent been able to create a good looking report where the emails could be easily read.

Anyone that has experience of creating an Email report from the Envelope Index db ?

Which queries/tools did you use, Andrew when evaluating the Zdziarski's method in the White Paper ?

- Anders

Thanks for the reply Andrew,

I am using sqliter browser and also the plugin for Firefox (https://addons.mozilla.org/en-US/firefox/addon/5817).

My problem is that it is quite difficult to create a nice looking report that contains all useful fields including the actual body of the mail.

We have now tried to read the dd file in Accessdata FTK 2 and all Emails (not deletd) are actually parsed out of the db and the Email view in FTK 2 will show them all in a very nice looking view. :-)

- Anders