From df213e24581a3b2b9ea5e750760b3582f4ea038f Mon Sep 17 00:00:00 2001
From: Costas K <11378310+kacos2000@users.noreply.github.com>
Date: Tue, 18 Jun 2019 17:32:50 +0300
Subject: [PATCH] IOS

---
 notes_sqlite.sql | 23 +++++++++++++++++++++++
 recents.sql      | 24 ++++++++++++++++++++++++
 2 files changed, 47 insertions(+)
 create mode 100644 notes_sqlite.sql
 create mode 100644 recents.sql

diff --git a/notes_sqlite.sql b/notes_sqlite.sql
new file mode 100644
index 0000000..1070880
--- /dev/null
+++ b/notes_sqlite.sql
@@ -0,0 +1,23 @@
+Select 
+znote.Z_PK,
+znote.ZGUID as 'GUID',
+zaccount.ZNAME as 'Account',
+zstore.ZNAME as 'Name',
+zstore.ZEXTERNALIDENTIFIER as' ID',
+znote.ZAUTHOR as 'Author',
+znote.ZTITLE as 'Title',
+znote.ZSUMMARY as 'Summary',
+znotebody.ZCONTENT as 'Content', --html
+znoteattachment.ZCONTENTID as 'contentID',
+znoteattachment.ZFILENAME as 'Filename',
+znoteattachment.ZMIMETYPE as 'mimetype',
+datetime('2001-01-01', znote.ZCREATIONDATE || ' seconds') as 'creationdate',
+datetime('2001-01-01', znote.ZMODIFICATIONDATE || ' seconds') as 'modificationdate'
+
+
+from znote
+join znotebody on znote.ZBODY = ZNOTEBODY.Z_PK
+join zstore on znote.ZSTORE = zstore.Z_PK
+join zaccount on zstore.ZACCOUNT = ZACCOUNT.Z_PK
+left join znoteattachment on znoteattachment."ZNOTE"  = znote.Z_PK
+order by creationdate desc
\ No newline at end of file
diff --git a/recents.sql b/recents.sql
new file mode 100644
index 0000000..d4f0783
--- /dev/null
+++ b/recents.sql
@@ -0,0 +1,24 @@
+-- IOS \Home\Library\Mail
+
+select 
+recents.ROWID,
+contacts.kind,
+recents.sending_address,
+contacts.address,
+contacts.display_name,
+metadata.key,
+metadata.value, --BLOB: bplist
+recents.original_source as 'source',
+recents.dates, --dates in Unix milliseconds
+datetime(recents.last_date/1000, 'unixepoch') as 'lastdate',
+recents.weight,
+recents.record_hash,
+recents."count",
+recents.group_kind 
+
+from recents
+ join contacts on recents.ROWID = contacts.recent_id 
+ left join metadata on metadata.recent_id = recents.ROWID
+
+-- group by recents.ROWID (to omit multiple entries)
+order by lastdate desc
\ No newline at end of file