MacOS X Call history decryptor/converter to CSV

ℹ PLEASE NOTE

since macOS 13 (Ventura) the Call History database appears to be not
encrypted. You can run the program with -no-key flag to view the call
history. The -k flag is no longer required, but still available for
earlier versions of macOS.

Converts the MacOS X call history to CSV file format.

This is the Golang implementation of the n0fates’ Call History
Decryptor, and is based on n0fate’s presentation descibing the
internals of the database:
https://papers.put.as/papers/macosx/2014/Forensic-artifacts-for-Yosemite-call-history-and-sms-anlaysis-ENG.pdf

Motivation for this implementation was:

to improve the usability by having just one binary executable;
increase the execution speed by using the standard library functions;
provide the convenient output format (CSV); and
describe the usage to make it more accessible to those who require getting the
call history from MacOS X for any reason, but lacking the time or the
technical knowledge required to set up the Python interpreter and packages
needed for the ogirinal implementation.

All credit for the decryption logic goes to n0fate.

Purpose

Decrypt and save the macOS call history to a CSV file.

Download

Downloads are available on the Releases page.

How this works

The program creates a copy of the original database in a temporary directory and
operates on that copy. After the Call History has been printed out, the
temporary file is deleted.

The original database is not changed during the execution.

For reference: macOS stores the Call History data in the following location:

"$HOME/Library/Application Support/CallHistoryDB/CallHistory.storedata"

Usage

Start the program with -h command line flag to see the usage help.

Simple usage:

$ ./osx-callhistory-decryptor [flags] [database_file]

Where database_file is optional os macOS (on Windows you’d have to provide the
filename).

macOS

Open the Terminal.app. (How?)

Start the call history decryptor:
```
 $ ./osx-callhistory-decryptor
```
It will try to locate the default call history file, make a temporary copy
and open it.

If you get the “Operation not permitted” on latest MacOSes:
1. Go into “System Preferences”;
2. Choose “Security and Privacy”;
3. Go to “Privacy” tab, select “Full Disk Access” item;
4. Add the Utilities/Terminal.app — or whatever you’re using — to the list.

You will be prompted for your user’s logon password - this allows the program
to fetch the callhistory encryption key from the OS X keychain. You can also
provide the call history encryption key manually using the -k command line
flag. Example:
```
 $ ./osx-callhistory-decryptor -k YSBzZWNyZXQga2V5IDEyCg==
```
The output will be printed onto the terminal by default. You can specify an
output file by providing the -o command line flag:
```
 $ ./osx-callhistory-decryptor -o output.csv
```

Opening a database from a non-default location

If, for any reason, you wish to open a different file than the default, the
first command line parameter should contain the filename location:

$ ./osx-callhistory-decryptor -o output.csv Calls.db

Specifying the custom time format

By default the time format is RFC3339 without the “T” time/date separator
("2006-01-02 15:04:05Z07:00"). Optionally, one can change that behaviour with
the -time-format flag by passing a different format. For example, if is
is required to have just a date and time, invoke program like so:

$ ./osx-callhistory-decryptor -time-format="2006-01-02 15:04"

The formatting is described in depth in the Go time package documentation.

Linux, Windows, etc.

You will need to obtain the database and the encryption key from the original
macOS system.

Get the copy of the CallHistory.storedata from source OS X machine. The file is stored in this location:
```
 $HOME/Library/Application Support/CallHistoryDB/CallHistory.storedata
```
with $HOME being the user’s home directory.

Copy it to the same directory where you’ve unpacked the ‘callhistory’
Get the key from the source macOS X keychain:
1. search the macOS X keychain for the Call History User Data Key
2. double-click the entry, and put the checkmark opposite the “show password” field.
3. Enter your user’s account password and copy the key value to the clipboard.
Open the terminal or cmd.exe prompt on Windows (How?). Start the
callhistory decryptor on your machine:
```
 C:>osx-callhistory-decryptor.exe -k <key value from step 2> <filename from step 1>
```
The output will be printed onto the terminal by default. You can specify an
output file by providing the -o command line flag:
```
 C:>osx-callhistory-decryptor.exe -o your_ex_callhistory_lol.csv <filename from step 1>
```

Licence

OS X Call history decryptor

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program. If not, see https://www.gnu.org/licenses.