iPhone image number...
 
Notifications
Clear all

iPhone image numbering sequence and many files absent

2 Posts
2 Users
0 Likes
447 Views
(@philhollis)
Posts: 1
New Member
Topic starter
 

We have received what was represented to be all of subject's iPhone images. We suspect a large number of deletions.

We need a acceptable source in document form to definitively explain the Apple iPhone image numbering regime. We have been told that importing or downloading from cloud could effect numbering sequence.

Also, if we attached a PDF of the file directory screen print, could someone tell us if deletions were likely or obvious. We need some authoritative document to present to Court. I have tried searching National Institute of Justice website and did not find any document to respond to what we seem to need something direct but concise and fairly simple.

Thanks for all assistance.

 
Posted : 23/10/2018 5:25 pm
(@mcman)
Posts: 189
Estimable Member
 

I don't have a document for you but whether you're getting an iCloud or iTunes backup, the numbering and naming isn't going to line up exactly what is on the phone. With any of those acquisitions, you're basically getting a logical dump through Apple's API, They choose to display it how they want. It definitely won't line up with how the data is physically stored on the phone. Unless you're getting a full file system dump from either a jailbroken phone or Graykey image, the backup structure is completely different.

With iOS 10+ backups you're getting a 2 character folder structure with a bunch of GUIDs to represent the files in the backup. Most of your tools can translate this by using the manifest file and present it in an easier to analyze format but that's not how it's pulled down.

The full file system structure is completely different on the phone itself so there needs to be a bit of a translation between the way it's stored on the phone vs how it's pulled into a backup.

Heather Mahalik did a decent write up on it here when iOS 10 came out and they made those changes. I think Elcomsoft has written a bunch about it as well.

https://smarterforensics.com/2016/09/a-glimpse-of-ios-10-from-a-smartphone-forensic-perspective/

Hope that helps,
Jamie

 
Posted : 23/10/2018 5:47 pm
Share: