Calendar

Overview

The macOS Calendar application (formerly iCal) stores all calendar data in a SQLite database called "Calendar Cache". This Core Data store contains events, attendees, locations, recurrence rules, alarms, and account synchronisation state across all configured calendar accounts (iCloud, Google, Exchange, CalDAV). Individual calendar events are also stored as ICS files on disk.

Forensic Significance

File Locations

Database Schema

The Calendar Cache is a Core Data SQLite store. Key entities:

ZCALENDARITEM (Events and Reminders)

ZATTENDEE

ZCALENDAR

Key Fields for Analysis

Essential Query

SELECT
    ci.ZTITLE AS title,
    ci.ZLOCATION AS location,
    datetime(ci.ZSTARTDATE + 978307200, 'unixepoch') AS start_time,
    datetime(ci.ZENDDATE + 978307200, 'unixepoch') AS end_time,
    ci.ZNOTES AS notes,
    c.ZTITLE AS calendar_name
FROM ZCALENDARITEM ci
LEFT JOIN ZCALENDAR c ON ci.ZCALENDAR = c.Z_PK
WHERE ci.Z_ENT = 16
ORDER BY ci.ZSTARTDATE DESC;

Events with Attendees

SELECT
    ci.ZTITLE AS event,
    datetime(ci.ZSTARTDATE + 978307200, 'unixepoch') AS start_time,
    a.ZCOMMONNAME AS attendee,
    a.ZADDRESS AS email
FROM ZCALENDARITEM ci
JOIN ZATTENDEE a ON a.ZEVENT = ci.Z_PK
WHERE ci.Z_ENT = 16
ORDER BY ci.ZSTARTDATE DESC;

Timestamps

Calendar uses Core Data timestamps (seconds since 2001-01-01 00:00:00 UTC).

Unix timestamp = core_data_timestamp + 978307200

Analysis Notes

• Meeting reconstruction: Combine event titles, locations, attendees, and notes to reconstruct meeting activity and identify who the user met with.
• Location tracking: Calendar event locations (both physical addresses and virtual meeting URLs like Zoom/Teams links) reveal movement patterns and communication tools used.
• Account enumeration: The calendar accounts configured on the system reveal organisational affiliations (Exchange accounts indicate employer, Google accounts may be personal).
• ICS files: Individual .ics files in the calendar directories contain event data in a text format that may include information not present in the SQLite cache.
• Deleted events: Core Data soft-deletes may leave traces of removed events in the database.
• Timezone analysis: Event timezones combined with creation timestamps can indicate where the user was when they created the event.

Version Differences

Tool Support

References

• Apple EventKit Documentation
• iCalendar Specification (RFC 5545)
• SANS FOR518: Mac and iOS Forensic Analysis