Pro plugin
FaceTime
Collects FaceTime call records, phone call history, and FaceTime Links from macOS
facetime.applePromacOS 10.13+v1.0.0communicationuserhistoryRun this plugin
Trigger collection for FaceTime on its own with the --plugin flag, or include it in a wider sweep by category.
# Just this plugin
macfor-pro collect --plugin facetime.apple --output ./evidence.zip
# Dry run — list what would be collected
macfor-pro collect --plugin facetime.apple --dry-runCompatibility
- macOS 10.13+
Licensing: ships in the macfor-pro binary. See Community vs Pro.
Artifacts (2 collected, 2 planned)
Each row corresponds to an entry in the plugin's artifacts.yaml manifest. Optionalartifacts are often absent, and their absence isn't recorded as an error. Plannedartifacts are documented locations the plugin doesn't collect yet. Where a path shows a version range, macfor only tries it when the source's macOS or application version is in that range.
history
| Artifact | Format | Path | Notes |
|---|---|---|---|
Call History Database callhistory_database | sqlite | ~/Library/Application Support/CallHistoryDB/CallHistory.storedata | — |
FaceTime Links Database facetime_links_databaseOptional | sqlite | ~/Library/Application Support/FaceTime/FaceTime.sqlite3macOS 12.0+ | — |
metadata
| Artifact | Format | Path | Notes |
|---|---|---|---|
Call History Database Info callhistory_infoPlanned — not collected yetOptional | binary_plist | ~/Library/Application Support/CallHistoryDB/com.apple.callhistory.databaseInfo.plist | — |
config
| Artifact | Format | Path | Notes |
|---|---|---|---|
FaceTime Preferences facetime_preferencesPlanned — not collected yetOptional | binary_plist | ~/Library/Preferences/com.apple.FaceTime.plist | — |