/spotlight_queries

Queries for parsed spotlight database in sqlite

MIT LicenseMIT

spotlight_queries

This is a repository of queries to be run against the spotlight database, after it has been parsed and converted to an sqlite database. Use either ios_apt, or mac_apt_artifact_only script (or exe) to parse the store.db (spotlight database) first. Then use these queries. Each query targets a specific artifact (like email or safari history), usually from a specific app and should be named as such.