How to know if a picture has been taken from this Apple device ?
Hello everyone, I hope you are well.
I've to analyze a FFS of an iPhone 7 IOS 13.3.1
During the analysis, I find a interesting picture, and I'd like to know if this picture has been taken from this iPhone
- The name of the photo is : IMG_0262.JPG
- She is store in : root/private/var/mobile/Media/DCIM/100APPLE/IMG_0262.JPG
- I can see it on a Gallery album called "Snapchat"
- I don't have any EXIF
-I find some references about this pictures in Photo.sqlite (Table: ZGENERICASSET(Z_PK: 276))
It is often said, "photos from the device's camera will reside in the DCIM directory.", but what if user copied a picture find on snapchat into that path ?
Is there any solution to know if a picture has been taken from this device if I don't have any EXIF ?
Thank you for your help.
Compelson's Camera Ballistics tool may meet your needs:
NOTE: I am not professionally associated with Compelson in any way but I do use MOBILedit Forensic in my practice.
Thank you !
Thank you !
I have the same question. I have 2 iphone 6 which are not jailbroken - one white colour and black colour which belong to my mom and dad. But, Through the years multiple backups were made and now i cant differentiate which photo came from either black or white iphone 6. Is there se identifier for a photo which can link to a device so i know which iphone took the photo ?