±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 32221
New Yesterday: 1 Visitors: 153

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

RSS Feed Widget

±Latest Webinars

Iphone photo numbering system

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

Iphone photo numbering system

Post Posted: Tue May 16, 2017 8:37 pm

Are there any "natural" circumstances in which the apple image file number would not be in sequential order based upon when they were taken ( on that specific device)?
Under what conditions would a lower file number have a date that is after other files with a higher file number.
Obvious answer is EXIF editor. but what else could explain it, if we ignore the first conclusion.

Photos were allegedly taken on Iphone6+

for simplicity...
IMG_0001 taken date 4/20/17
IMG_0009 taken date 4/01/17

1. EXIF editor
2. Could of come from another Iphone 6+ device

**No phone has been forensically dumped or examined. (yet)
We only have the 2 photos at this time to compare.

I have read in a white paper that images sent, for example thru airdrop, will be renumbered by the receiving device current number scheme.
I do not have precise date range yet in which the discrepancy occurred.
I have not yet seen the exif data for myself yet.  

Tackleberry
Member
 
 
  

Re: Iphone photo numbering system

Post Posted: Tue May 16, 2017 10:08 pm

Yes, airdrop would have been my guess.  

SamBrown
Senior Member
 
 
  

Re: Iphone photo numbering system

Post Posted: Wed May 17, 2017 7:46 am

UPDATE:
i have viewed EXIF data in reader program.
BOTH indicated model "iPhone 6s Plus"

img_0001 HAS ORIGINAL taken date of 12-19-2016,
*there is matching change date and digitized date in Exif viewer fields
Software field in EXIF viewer says Camera+ 9.0.1 ( which is 3rd a party APP)
App change-log below..
06-22-16 V# 8.0.2 released
12-14-16 v# 9
12-17-16 V# 9.0.1
12-22-16 V# 9.0.2
03-22-17 V # 9.1
So I would believe it was taken with this 3rd party APP 2 days after the iphone had this app either installed, or update.


img_0002 has ORIGINAL taken date of 11-23-16.
*again other matching fields in EXIF viewer to this date.
Software field in EXIF viewer say 10.1
my best estimate on IOS 10.1 release was Oct. 24th 2016. It "appears" the IOS update was done in a timely fashion and this image was taken with the OEM camera app, so probably the 3rd party app had yet to be installed.

Comes back to WHY does img_0002 have a creation date the precedes the img_001.

I adjusted image # for simplicity. Actual img numbers are as follows.

IMG_6577 = IMG_0001
IMG_6578 = IMG_0002

but the higher file eliminated the possible logic that the photos files were simply rolled back to first image of camera's life..  

Tackleberry
Member
 
 
  

Re: Iphone photo numbering system

Post Posted: Fri May 19, 2017 3:08 pm

Im not sure if im following your question correctly but wonndering if this help


http://www.controlf.net/content/uploads/PhotoStream-attribution-DRAFT-14-NOV-2016.pdf  

Principle3Notes
Newbie
 
 

Reply to topicReply to topic

Share and Like this forum topic to get more replies




Page 1 of 1