{"id":13582281,"url":"https://github.com/rusq/osx-callhistory-decryptor","last_synced_at":"2025-05-12T13:29:41.745Z","repository":{"id":46959004,"uuid":"140985905","full_name":"rusq/osx-callhistory-decryptor","owner":"rusq","description":"macOS (incl big sur) call history decryptor/converter to CSV format.","archived":false,"fork":false,"pushed_at":"2023-02-16T11:13:46.000Z","size":76,"stargazers_count":29,"open_issues_count":1,"forks_count":1,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-03-28T10:18:10.638Z","etag":null,"topics":["aes","aes-gcm","bigsur","call","call-history","converter","csv","database","decryption","golang","history","keychain","macos","osx","transactions"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/rusq.png","metadata":{"files":{"readme":"README.md","changelog":"historydecryptor/getkey.go","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-07-14T23:59:03.000Z","updated_at":"2024-11-14T10:19:33.000Z","dependencies_parsed_at":"2024-06-20T04:16:22.150Z","dependency_job_id":"aa717137-5d3a-42ca-a746-310627fa5aa4","html_url":"https://github.com/rusq/osx-callhistory-decryptor","commit_stats":null,"previous_names":[],"tags_count":6,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rusq%2Fosx-callhistory-decryptor","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rusq%2Fosx-callhistory-decryptor/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rusq%2Fosx-callhistory-decryptor/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rusq%2Fosx-callhistory-decryptor/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/rusq","download_url":"https://codeload.github.com/rusq/osx-callhistory-decryptor/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246553017,"owners_count":20795834,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aes","aes-gcm","bigsur","call","call-history","converter","csv","database","decryption","golang","history","keychain","macos","osx","transactions"],"created_at":"2024-08-01T15:02:34.126Z","updated_at":"2025-04-01T08:31:42.826Z","avatar_url":"https://github.com/rusq.png","language":"Go","funding_links":[],"categories":["Go"],"sub_categories":[],"readme":"# MacOS X Call history decryptor/converter to CSV\n\n[![Build Status](https://travis-ci.org/rusq/osx-callhistory-decryptor.svg?branch=master)](https://travis-ci.org/rusq/osx-callhistory-decryptor)\n\n\u003e ℹ PLEASE NOTE\n\u003e \n\u003e since macOS 13 (Ventura) the Call History database appears to be not\n\u003e encrypted.  You can run the program with `-no-key` flag to view the call\n\u003e history.  The `-k` flag is no longer required, but still available for\n\u003e earlier versions of macOS.\n\nConverts the MacOS X call history to CSV file format.\n\nThis is the Golang implementation of the [n0fates'][1] [Call History\nDecryptor][2], and is based on [n0fate's][1] presentation descibing the\ninternals of the database:\nhttps://papers.put.as/papers/macosx/2014/Forensic-artifacts-for-Yosemite-call-history-and-sms-anlaysis-ENG.pdf\n\nMotivation for this implementation was:\n\n* to improve the usability by having just one binary executable;\n* increase the execution speed by using the standard library functions;\n* provide the convenient output format (CSV); and\n* describe the usage to make it more accessible to those who require getting the\n  call history from MacOS X for any reason, but lacking the time or the\n  technical knowledge required to set up the Python interpreter and packages\n  needed for the [ogirinal implementation][2].\n\nAll credit for the decryption logic goes to [n0fate][1].\n\n## Purpose\nDecrypt and save the macOS call history to a CSV file.\n\n## Download\nDownloads are available on the [Releases page][5].\n\n## How this works\n\nThe program creates a copy of the original database in a temporary directory and\noperates on that copy.  After the Call History has been printed out, the\ntemporary file is deleted.\n\nThe original database is not changed during the execution.\n\nFor reference:  macOS stores the Call History data in the following location:\n\n    \"$HOME/Library/Application Support/CallHistoryDB/CallHistory.storedata\"\n\n## Usage\nStart the program with `-h` command line flag to see the usage help.\n\nSimple usage:\n\n    $ ./osx-callhistory-decryptor [flags] [database_file]\n\nWhere `database_file` is optional os macOS (on Windows you'd have to provide the\nfilename).\n\n## macOS\n\nOpen the Terminal.app. ([How?][3])\n\n1. Start the call history decryptor:\n\n        $ ./osx-callhistory-decryptor\n\n   It will try to locate the default call history file, make a temporary copy\n   and open it.\n\n   If you get the \"Operation not permitted\" on latest MacOSes:\n\n\t1. Go into \"System Preferences\";\n\t2. Choose \"Security and Privacy\";\n\t3. Go to \"Privacy\" tab, select \"Full Disk Access\" item;\n\t4. Add the Utilities/Terminal.app — or whatever you're using — to the list.\n\n\n2. You will be prompted for your user's logon password - this allows the program\n   to fetch the callhistory encryption key from the OS X keychain.  You can also\n   provide the call history encryption key manually using the `-k` command line\n   flag. Example:\n\n        $ ./osx-callhistory-decryptor -k YSBzZWNyZXQga2V5IDEyCg==\n\n3. The output will be printed onto the terminal by default.  You can specify an\n   output file by providing the `-o` command line flag:\n\n        $ ./osx-callhistory-decryptor -o output.csv\n\n### Opening a database from a non-default location\nIf, for any reason, you wish to open a different file than the default, the\nfirst command line parameter should contain the filename location:\n\n    $ ./osx-callhistory-decryptor -o output.csv Calls.db\n\n### Specifying the custom time format\nBy default the time format is RFC3339 without the \"T\" time/date separator\n(`\"2006-01-02 15:04:05Z07:00\"`).  Optionally, one can change that behaviour with\nthe `-time-format` flag by passing a [different format][6].  For example, if is\nis required to have just a date and time, invoke program like so:\n\n    $ ./osx-callhistory-decryptor -time-format=\"2006-01-02 15:04\"\n\nThe formatting is described in depth in the [Go time package documentation][6].\n\n## Linux, Windows, etc.\n\nYou will need to obtain the database and the encryption key from the original\nmacOS system.\n\n1. Get the copy of the `CallHistory.storedata` from source OS X machine.  The file is stored in this location:\n        \n        $HOME/Library/Application Support/CallHistoryDB/CallHistory.storedata\n\n    with `$HOME` being the user's home directory.\n\n    Copy it to the same directory where you've unpacked the 'callhistory'\n\n2. Get the key from the source macOS X keychain:\n    \n    1. search the macOS X keychain for the *Call History User Data Key*\n    2. double-click the entry, and put the checkmark opposite the \"show password\" field.\n    3. Enter your user's account password and copy the key value to the clipboard.\n\n3. Open the terminal or cmd.exe prompt on Windows ([How?][4]).  Start the\n   callhistory decryptor on your machine:\n\n        C:\u003eosx-callhistory-decryptor.exe -k \u003ckey value from step 2\u003e \u003cfilename from step 1\u003e\n\n4. The output will be printed onto the terminal by default.  You can specify an\n   output file by providing the `-o` command line flag:\n\n        C:\u003eosx-callhistory-decryptor.exe -o your_ex_callhistory_lol.csv \u003cfilename from step 1\u003e\n\n## Licence \nOS X Call history decryptor\n\nCopyright (C) 2016  n0fate (GPL2 license)\n\nCopyright (C) 2018-2021  rusq (golang implementation, GPL3)\n\nThis program is free software: you can redistribute it and/or modify\nit under the terms of the GNU General Public License as published by\nthe Free Software Foundation, either version 3 of the License, or\n(at your option) any later version.\n\nThis program is distributed in the hope that it will be useful,\nbut WITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the\nGNU General Public License for more details.\n\nYou should have received a copy of the GNU General Public License\nalong with this program.  If not, see \u003chttps://www.gnu.org/licenses/\u003e.\n\n\n[1]: https://github.com/n0fate/\n[2]: https://github.com/n0fate/OS-X-Continuity\n[3]: http://blog.teamtreehouse.com/introduction-to-the-mac-os-x-command-line\n[4]: https://www.wikihow.com/Open-the-Command-Prompt-in-Windows\n[5]: https://github.com/rusq/osx-callhistory-decryptor/releases\n[6]: https://golang.org/pkg/time/#pkg-constants\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frusq%2Fosx-callhistory-decryptor","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frusq%2Fosx-callhistory-decryptor","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frusq%2Fosx-callhistory-decryptor/lists"}