Disassociated but not Forgotten Attachments
It seems some attachments are no longer associated with those in the ZINTERACTIONS Table but are not necessarily removed from the ZATTACHMENTS Table. This has potential forensic use as well. APOLLO will not extract these as there doesn’t appear to be timestamps associated with it however, I HIGHLY recommend at least taking a brief look at this table when doing an investigation.
The example below shows may attachment files of different types were associated with a contact interaction.
-
PDF
-
Images (PNG, HEIC, JPG)
-
Contact VCard
-
Text
-
Archives
-
Movies
-
Documents
Unfortunately, we lose the contact context here. However, we can still find useful tidbits of information like text, file types, URLs, image UUIDs, etc.
