diff --git a/Photos.xml b/Photos.xml
new file mode 100644
index 0000000..ce8b1f8
--- /dev/null
+++ b/Photos.xml
@@ -0,0 +1,302 @@
+
+
+
+ Photos.sqlite
+
+-- IOS 8+ - Camera Roll\Media\PhotoData\Photos.sqlite
+
+-- Referencess:
+--
+-- https://github.com/geiszla/iOSLib/wiki/ZGENERICASSET-contents
+-- https://github.com/geiszla/iOSLib/wiki/ZADDITIONALASSETATTRIBUTES-contents
+-- https://forensenellanebbia.blogspot.com/2015/10/apple-ios-recently-deleted-images.html
+-- SIDECAR https://en.wikipedia.org/wiki/Sidecar_file
+--
+-- Live Photo is a video-picture hybrid file with both animated MOV and static JPG combined.
+-- https://appletoolbox.com/live-photos-on-iphone-complete-guide/
+--
+-- OriginalFilename is the filename used when this was shared in another app
+-- Filename is the IOS converted filename after the above image was saved on the device(iPhone)
+--
+-- Z_PK = Primary Key (unique identifier) for the entity,
+-- Z_ENT = is the entity ID (every entity of a particular type has the same entity ID)
+-- Z_OPT = number of times an entity has been changed
+--
+-- https://linuxsleuthing.blogspot.com/2013/05/ios6-photo-streams-recover-deleted.html
+-- https://discussions.apple.com/thread/8184861
+
+
+select
+ zgenericasset.Z_PK as 'zpk',
+ case zgenericasset.ZSAVEDASSETTYPE
+ when 0 then 'Saved from other source'
+ when 2 then 'Photo Streams Data'
+ when 3 then 'Made/saved with this device'
+ when 4 then 'Default row'
+ when 7 then 'Deleted'
+ else zgenericasset.ZSAVEDASSETTYPE
+ end as 'AssetType',
+ zgenericasset.ZDIRECTORY as 'Directory',
+ zgenericasset.ZFILENAME as 'FileName',
+ ZADDITIONALASSETATTRIBUTES.ZORIGINALFILENAME as 'OriginalFilename',
+ ZADDITIONALASSETATTRIBUTES.ZORIGINALFILESIZE as 'OriginalSize',
+-- zgenericasset.ZORIGINALCOLORSPACE as 'ColorSpace',
+ zgenericasset.ZUNIFORMTYPEIDENTIFIER as 'FormType',
+ ZSIDECARFILE.ZFILENAME as ' SidecarFilename',
+ ZSIDECARFILE.ZORIGINALFILENAME as 'SidecarOriginalF',
+ ZSIDECARFILE.ZCOMPRESSEDSIZE as ' CompressedSize',
+ ZSIDECARFILE.ZUNIFORMTYPEIDENTIFIER as 'SidecarFormType',
+ ZIMAGEURLDATA as 'ImageURLdata',
+ ZTHUMBNAILURLDATA as 'ThumbnailURLdata',
+-- case zgenericasset.ZLATITUDE
+ -- when -180.0
+ -- then ''
+ -- else zgenericasset.ZLATITUDE
+ -- end as ' Latitude',
+-- case zgenericasset.ZLONGITUDE
+ -- when -180.0
+ -- then ''
+ -- else zgenericasset.ZLONGITUDE
+ -- end as ' Longitude',
+ case ZCLOUDDOWNLOADREQUESTS
+ when 0 then 'No'
+ when 1 then 'Yes'
+ end as 'CLOUDDOWNLOADREQUESTS',
+ case ZCLOUDISDELETABLE
+ when 1 then 'Yes'
+ end as 'CLOUDISDELETABLE',
+ case ZCLOUDISMYASSET
+ when 1 then 'Yes'
+ end as 'CLOUDISMYASSET',
+ case ZCLOUDLOCALSTATE
+ when 0 then 'Local'
+ when 1 then 'Remote'
+ end as 'CLOUDLOCALSTATE',
+ case ZFAVORITE
+ when 0 then 'No'
+ when 1 then 'Yes'
+ end as 'Favorite',
+ case ZHASADJUSTMENTS
+ when 0 then 'No'
+ when 1 then 'Yes'
+ end as 'Modified',
+ ZWIDTH||' x '||ZHEIGHT as 'Dimenasions',
+ ZADDITIONALASSETATTRIBUTES.ZEMBEDDEDTHUMBNAILWIDTH||' x '||ZADDITIONALASSETATTRIBUTES.ZEMBEDDEDTHUMBNAILHEIGHT as 'EmbeddedThumbnail',
+ ZADDITIONALASSETATTRIBUTES.ZEMBEDDEDTHUMBNAILOFFSET as 'EmbeddedThumbnailOffset',
+ ZADDITIONALASSETATTRIBUTES.ZEMBEDDEDTHUMBNAILLENGTH as 'ETNLength',
+ time(ZDURATION,'unixepoch') as 'Duration',
+ time(zgenericasset.ZVIDEOCPDURATIONVALUE, 'unixepoch') as 'CPDuration',
+ case ZORIENTATION
+ when 1 then 'Horizontal (left)'
+ when 3 then 'Horizontal (right)'
+ when 6 then 'Vertical (up)'
+ when 8 then 'Vertical (down)'
+ else ZORIENTATION
+ end as 'Orientation',
+ case ZKIND
+ when 0 then 'Photo'
+ when 1 then 'Video'
+ end as 'Kind',
+ case ZKINDSUBTYPE
+ when 0 then 'Normal'
+ when 1 then 'Panorama'
+ when 100 then 'Default row'
+ when 101 then 'Slo-mo'
+ when 102 then 'Timelapse'
+ else ZKINDSUBTYPE
+ end as 'SubType',
+ case zgenericasset.ZTRASHEDSTATE
+ when 1 then 'Deleted'
+ when 0 then 'Not Deleted'
+ else zgenericasset.ZTRASHEDSTATE
+ end as 'TrashState',
+ datetime('2001-01-01', ZTRASHEDDATE || ' seconds') as 'TrashedDate',
+ case ZCOMPLETE
+ when 1 then 'Yes'
+ end as 'Complete',
+ case ZVISIBILITYSTATE
+ when 0 then 'Visible'
+ when 1 then 'Photo Streams Data'
+ when 2 then 'Burst'
+ else ZVISIBILITYSTATE
+ end as 'VisibilityState',
+ ZADDITIONALASSETATTRIBUTES.ZCREATORBUNDLEID as 'CreatorBundleID',
+ ZADDITIONALASSETATTRIBUTES.ZEDITORBUNDLEID as 'EditorBundleID',
+ ZUNMANAGEDADJUSTMENT.ZADJUSTMENTFORMATIDENTIFIER||' ('||ZUNMANAGEDADJUSTMENT.ZADJUSTMENTFORMATVERSION||')' as 'AdjustmentFormatIdentifier',
+ ZSIDECARFILE.ZCAPTUREDATE as 'SidecarCaptudeDate',
+ ZSIDECARFILE.ZMODIFICATIONDATE as 'SidecarModificationDate',
+ ZUNMANAGEDADJUSTMENT.ZADJUSTMENTTIMESTAMP as 'AdjustmentTimestamp',
+-- datetime('2001-01-01', zgenericasset.ZFACEADJUSTMENTVERSION as 'FaceAdjustmentVersion',
+ ZGENERICASSET.ZMODIFICATIONDATE as 'ModificationDate',
+ ZADDEDDATE as 'AddedDate',
+ ZDATECREATED as 'CreatedDate',
+ ZADDITIONALASSETATTRIBUTES.ZEXIFTIMESTAMPSTRING as 'EXIFtimestamp',
+ ZMOMENT.ZSTARTDATE as 'MomentStartDate',
+ ZMOMENT.ZENDDATE as 'MomentEndDate',
+ zgenericasset.ZLASTSHAREDDATE as 'LastSharedDate',
+ ZADDITIONALASSETATTRIBUTES.ZTIMEZONENAME||' ('||ZADDITIONALASSETATTRIBUTES.ZTIMEZONEOFFSET||')' as 'TimeZone',
+ ZMOMENT.ZAPPROXIMATELOCATIONDATA as 'ApproximateLocationData(bplist)',
+ ZMOMENT.ZREVERSELOCATIONDATA as 'ReverseLocationData0(bplist)',
+ case ZMOMENT.ZREVERSELOCATIONDATAISVALID
+ when 0 then 'No'
+ when 1 then 'Yes'
+ end as 'LocationValid',
+ ZMOMENTLIST.ZREVERSELOCATIONDATA as 'ReverseLocationData1(bplist)',
+ case ZMOMENTLIST.ZREVERSELOCATIONDATAISVALID
+ when 0 then 'No'
+ when 1 then 'Yes'
+ end as 'LocationValid1',
+-- case ZADDITIONALASSETATTRIBUTES.ZSHIFTEDLOCATIONISVALID -- Field does not exist in IOS 8.3
+-- when 0 then 'No'
+-- when 1 then 'Yes'
+-- end as 'ShiftedLocationValid,'
+ ZADDITIONALASSETATTRIBUTES.ZREVERSELOCATIONDATA as 'ReverseLocationData2'
+
+from zgenericasset
+ join Z_PRIMARYKEY on zgenericasset.z_ent = Z_PRIMARYKEY.z_ent
+ left join ZMOMENTLIST on zgenericasset.ZMOMENT = ZMOMENTLIST.Z_PK
+ left join ZMOMENT on ZGENERICASSET."ZMOMENT" = ZMOMENT.Z_PK
+ join ZADDITIONALASSETATTRIBUTES on ZGENERICASSET.ZADDITIONALATTRIBUTES = ZADDITIONALASSETATTRIBUTES.Z_PK
+ left join ZUNMANAGEDADJUSTMENT on ZADDITIONALASSETATTRIBUTES."ZUNMANAGEDADJUSTMENT" = ZUNMANAGEDADJUSTMENT.Z_PK
+ left join ZSIDECARFILE on ZSIDECARFILE.ZASSET = ZGENERICASSET.Z_PK
+-- order by CreatedDate desc
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ iPhotoLite.db
+
+ --IOS 9 (iphoto)
+ --\Camera Roll\Media\PhotoData\iPhotoSandboxLibrary\438665323315681\Database\iPhotoLite.db
+
+ select
+ BLDBAlbum.uuid as 'AlbumUUID', -- Foldername
+ BLDBAlbumMediaJoin.type, -- value can also be seen in the Album.plist in the above folders
+ BLDBAlbum.name||' ('||BLDBAlbum.itemCount||')' as 'AlbumNamecount',
+ case BLDBAlbum.state
+ when 1
+ then 'Exists'
+ end as 'AlbumState',
+ case bldbmedia.state
+ when 0 then 'Deleted'
+ end as 'MediaState',
+ bldbmedia.uuid 'MediaUUID',
+ bldbmedia.fileName,
+ bldbmedia.fileSize,
+ bldbmedia.type as 'imageType',
+ time(bldbmedia.duration,'unixepoch') as 'Duration',
+ bldbmedia.latitude,
+ bldbmedia.longitude,
+ bldbmedia.DateCreated as 'DateCreated',
+ case
+ when bldbmedia.dateViewed != 0.0
+ then bldbmedia.dateViewed
+ end as 'DateViewed',
+ case
+ when bldbmedia.dateAdjusted
+ then bldbmedia.dateAdjusted
+ end as 'DateAdjusted',
+ case
+ when bldbmedia.dateModified
+ then bldbmedia.dateModified
+ end as 'DateModified',
+ bldbmedia.PixelWidth||' x '||bldbmedia.PixelHeight as 'Dimensions',
+ bldbmedia.assetPixelWidth||' x '||bldbmedia.assetPixelHeight as 'assetDimensions',
+ bldbmedia.originalPixelWidth||' x '||bldbmedia.originalPixelHeight as 'originalDimensions',
+ case bldbmedia.assetOrientation
+ when 1 then 'Horizontal (left)'
+ when 3 then 'Horizontal (right)'
+ when 6 then 'Vertical (up)'
+ when 8 then 'Vertical (down)'
+ else bldbmedia.assetOrientation
+ end as 'AssetOrientation',
+ case bldbmedia.originalOrientation
+ when 1 then 'Horizontal (left)'
+ when 3 then 'Horizontal (right)'
+ when 6 then 'Vertical (up)'
+ when 8 then 'Vertical (down)'
+ else bldbmedia.originalOrientation
+ end as 'OriginalOrientation'
+ from bldbmedia
+ join BLDBAlbumMediaJoin on BLDBMedia.primaryKey = BLDBAlbumMediaJoin.mediaKey
+ join BLDBAlbum on BLDBAlbumMediaJoin.albumKey = BLDBAlbum.primaryKey
+-- order by DateCreated desc
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/healthdb_secure.xml b/healthdb_secure.xml
new file mode 100644
index 0000000..0cdc1ce
--- /dev/null
+++ b/healthdb_secure.xml
@@ -0,0 +1,46 @@
+
+
+
+ healthdb_secure.sqlite
+
+ select
+ data_provenances.origin_device||' ('||data_provenances.source_version||')' as 'Device',
+ case samples.data_type
+ when 3 then 'Weight'
+ when 5 then 'Heart Rate'
+ when 7 then 'Steps'
+ when 8 then 'Distance'
+ when 9 then 'Resting Energy'
+ when 10 then 'Active Energy'
+ when 12 then 'Flights Climbed'
+ when 67 then 'Weekly Calorie Goal'
+ when 70 then 'Watch On'
+ when 75 then 'Standing'
+ when 76 then 'Activity'
+ when 79 then 'Workout'
+ when 83 then 'Some workouts'
+ else samples.data_type -- 20’s ~ 30’s = Nutrition
+ end as 'DataType',
+ quantity_samples.original_quantity||' '||unit_strings.unit_string as 'quantity',
+ quantity_samples.quantity as 'originalquantity',
+ samples.start_date as 'StartDate',
+ samples.end_date as 'EndDate'
+ from samples
+ left join activity_caches on activity_caches.data_id = samples.data_id
+ left join quantity_samples on quantity_samples.data_id = samples.data_id
+ left join correlations on samples.data_id = correlations.object
+ left join data_provenances on data_provenances.ROWID = quantity_samples.original_unit
+ left join unit_strings on unit_strings.ROWID = quantity_samples.original_unit
+
+
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/logs_db.xml b/logs_db.xml
new file mode 100644
index 0000000..6424028
--- /dev/null
+++ b/logs_db.xml
@@ -0,0 +1,111 @@
+
+
+
+ logs.db
+
+ -- sec = (Samsung Electronics Corporation)
+ -- \data\com.sec.android.provider.logsproviders\logs.db
+
+ Select
+ logs._id as 'id',
+ logs.geocoded_location||' ('||logs.countryiso||')' as 'Location',
+ logs.name,
+ logs.number,
+ case logs.numbertype
+ when 1 then 'Home'
+ when 2 then 'Mobile'
+ when 3 then 'Work'
+ when 4 then 'Fax_Work'
+ when 5 then 'Fax_Home'
+ when 6 then 'Pager'
+ when 7 then 'Other'
+ when 8 then 'Callback'
+ when 9 then 'Car'
+ when 10 then 'Company_Main'
+ when 11 then 'ISDN'
+ when 12 then 'Main'
+ when 13 then 'Other_Fax'
+ when 14 then 'Radio'
+ when 15 then 'Telex'
+ when 16 then 'TTY_TDD'
+ when 17 then 'Work_Mobile'
+ when 18 then 'Work_Pager'
+ when 19 then 'Assistant'
+ when 20 then 'MMS'
+ else logs.numbertype
+ end as 'numbertype',
+ case logs.presentation
+ when 1 then 'allowed' --Number is allowed to display for caller id
+ when 2 then 'restricted' --Number is blocked by user
+ when 3 then 'unknown' --Number is not specified or unknown by network
+ when 4 then 'pay phone' --Number is a pay phone
+ else logs.presentation
+ end as 'CallerID',
+ logs.date as 'lDate',
+ case
+ when logs.duration != 0
+ then Time(logs.duration, 'unixepoch')
+ end as 'Duration',--The duration of the call in seconds
+ case logs.type
+ when 1 then 'incoming' --incoming calls
+ when 2 then 'outgoing' --outgoing calls
+ when 3 then 'missed' --missed calls
+ when 4 then 'voicemail' --Call log type for voicemails
+ when 5 then 'rejected' --rejected by direct user action
+ when 6 then 'blocked' --calls blocked automatically
+ when 7 then 'answered externally' --call which was answered on another device
+ else logs.type
+ end as 'type',
+ case
+ when logs.logtype in (100)
+ then 'Call ('||logs.logtype||')'
+ when logs.logtype in (300)
+ then 'SMS ('||logs.logtype||')'
+ when logs.logtype in (400)
+ then 'Email ('||logs.logtype||')'
+ else 'Other ('||logs.logtype||')'
+ end as 'logtype',
+ logs.messageid,
+ case logs.is_read
+ when 0 then 'No'
+ when 1 then 'Yes'
+ end as 'IsRead',
+ logs.m_subject as 'MessageSubject',
+ logs.m_content as 'MessageContent',
+ case logs."new"
+ when 1 then 'Yes'
+ end as 'New',
+ logs.contactid,
+ logs.raw_contact_id as 'rawcontactid',
+ logs.lookup_uri as 'lookupuri',
+ logs.photo_id as 'photoid',
+ logs.account_name||' ('||logs.account_id||')' as 'Account'
+ from logs
+ -- order by lDate desc
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file