FaceTime

Overview

FaceTime is Apple's built-in video and audio calling application on macOS. Call history is stored in CallHistory.storedata, a Core Data SQLite database shared with the Phone app on devices that support telephony. This database contains metadata for all calls -- both FaceTime (audio and video) and standard phone calls -- including timestamps, duration, direction, answered status, participant information, and screen sharing indicators.

Since macOS 12 Monterey, FaceTime also supports shareable meeting links (similar to Zoom or Google Meet), stored in a separate FaceTime.sqlite3 database.

FaceTime uses a dual database architecture:

1. CallHistory.storedata -- Call records for all call types (FaceTime + Phone).
2. FaceTime.sqlite3 -- FaceTime Links (shareable meeting URLs).

File Locations

Database Schema / File Format

Both databases use the Core Data framework, which means tables are prefixed with Z and use Z_PK as the primary key.

CallHistory.storedata

The primary table is ZCALLRECORD containing one row per call. Participants in group calls are tracked through a join table. See Call History for the complete schema.

FaceTime.sqlite3

Contains the ZCONVERSATIONLINK table for FaceTime Links. See Call History for details.

Key Fields for Analysis

• ZCALLTYPE: Distinguishes phone calls (1) from FaceTime video (8) and FaceTime audio (16).
• ZSERVICE_PROVIDER: com.apple.FaceTime vs com.apple.Telephony definitively identifies the call service.
• ZORIGINATED: Call direction: 0 = incoming, 1 = outgoing.
• ZANSWERED: Whether the call was answered (1) or missed/declined (0).
• ZDURATION: Call duration in seconds (float). Zero duration typically means a missed or declined call.
• ZSCREENSHARINGTYPE: Non-zero indicates screen sharing was active (SharePlay).

Timestamps

CallHistory.storedata uses Core Data timestamps (seconds since 2001-01-01 00:00:00 UTC):

SELECT datetime(ZDATE + 978307200, 'unixepoch') AS call_date_utc
FROM ZCALLRECORD;

FaceTime.sqlite3 uses the same Core Data timestamp format for ZCREATIONDATE, ZEXPIRATIONDATE, and ZDELETIONDATE.

Analysis Notes

• Shared database: CallHistory.storedata contains both FaceTime and regular phone call records. Filter by ZSERVICE_PROVIDER = 'com.apple.FaceTime' to isolate FaceTime-specific calls.
• Group calls: Group FaceTime calls are identified by a non-null ZPARTICIPANTGROUPUUID column. Participants are resolved through the Z_2REMOTEPARTICIPANTHANDLES join table.
• FaceTime Links: Shareable meeting URLs introduced in macOS 12 Monterey. The ZPRIVATEKEY and ZPUBLICKEY columns contain encryption keys that should not be collected for privacy reasons.
• Call history retention: macOS does not automatically purge call history. Records may span years of activity.
• Cross-device sync: Call history may sync across Apple devices via iCloud, meaning the Mac database may contain calls made from an iPhone.

Version Differences

Tool Support

References

• iLEAPP Call History Parser
• APOLLO Call History Module
• kacos2000 CallHistory SQL Queries