Get macfor Pro

Pro plugin

FaceTime

Collects FaceTime call records, phone call history, and FaceTime Links from macOS

facetime.applePromacOS 10.13+v1.0.0communicationuserhistory

Run this plugin

Trigger collection for FaceTime on its own with the --plugin flag, or include it in a wider sweep by category.

# Just this plugin
macfor-pro collect --plugin facetime.apple --output ./evidence.zip

# Dry run — list what would be collected
macfor-pro collect --plugin facetime.apple --dry-run

Compatibility

  • macOS 10.13+

Licensing: ships in the macfor-pro binary. See Community vs Pro.

Artifacts collected (4)

Each row corresponds to an entry in the plugin's artifacts.yaml manifest. Optional artifacts are skipped unless explicitly enabled.

history

ArtifactFormatPathNotes
Call History Database
callhistory_database
sqlite~/Library/Application Support/CallHistoryDB/CallHistory.storedata—
FaceTime Links Database
facetime_links_databaseOptional
sqlite~/Library/Application Support/FaceTime/FaceTime.sqlite3—

metadata

ArtifactFormatPathNotes
Call History Database Info
callhistory_infoOptional
binary_plist~/Library/Application Support/CallHistoryDB/com.apple.callhistory.databaseInfo.plist—

config

ArtifactFormatPathNotes
FaceTime Preferences
facetime_preferencesOptional
binary_plist~/Library/Preferences/com.apple.FaceTime.plist—