Starting from the beginning I imaged data partition from Iphone via SSH+Wi-Fi . Everything seems fine - I have approx 7GB dump in DD format. I copied AdressBook.sqlitedb file from image to hdd, and that file I opened in SQLITE STUDIO application.
I know that 2 contacts was deleted. In ABPerson Table row count is not equal to ID count (and that's correct)
I know contact names and I found them using live search option in FTK 3
That entries are still in AdressBook.sqlitedb file (I see them on hex preview) but they are not accessible in Iphone neither then sqlite viewers.
How to "recover" that deleted contacts ?
Take a look at the SQLite File Format http//
Each record from a particular table will have a "fingerprint" (not a static signature, but something you can latch onto), work out the fingerprint, search and recorver (in the broadest terms possible!)
I covered a summary of the technique at the recent F3 training day. Slides are here http//
Everybody want to learn something new, but is any easier way to do that ? ) I mean less time consuming way, maybe perl script, software to download etc ?