How to know if a pi...
 
Notifications
Clear all

How to know if a picture has been taken from this Apple device ?

8 Posts
6 Users
0 Reactions
4,130 Views
(@eilco)
Eminent Member
Joined: 6 years ago
Posts: 12
Topic starter  

Hello everyone, I hope you are well.

I've to analyze a FFS of an iPhone 7 IOS 13.3.1

 

During the analysis, I find a interesting picture, and I'd like to know if this picture has been taken from this iPhone

- The name of the photo is : IMG_0262.JPG

- She is store in : root/private/var/mobile/Media/DCIM/100APPLE/IMG_0262.JPG

- I can see it on a Gallery album called "Snapchat"

- I don't have any EXIF

-I find some references  about this pictures in Photo.sqlite (Table: ZGENERICASSET(Z_PK: 276))

 

It is often said, "photos from the device's camera will reside in the DCIM directory.", but what if user copied a picture find on snapchat into that path ?

 

Is there any solution to know if a picture has been taken from this device if I don't have any EXIF ?

 

Thank you for your help.

 


   
Quote
UnallocatedClusters
(@unallocatedclusters)
Honorable Member
Joined: 13 years ago
Posts: 576
 

Compelson's Camera Ballistics tool may meet your needs:

 

https://www.mobiledit.com/camera-ballistics

NOTE:  I am not professionally associated with Compelson in any way but I do use MOBILedit Forensic in my practice.


   
ReplyQuote
(@eilco)
Eminent Member
Joined: 6 years ago
Posts: 12
Topic starter  

Thank you !


   
ReplyQuote
(@gfshusbandforever)
Active Member
Joined: 3 years ago
Posts: 6
 
Posted by: @unallocatedclusters

Compelson's Camera Ballistics tool may meet your needs:

 

https://www.mobiledit.com/camera-ballistics

NOTE:  I am not professionally associated with Compelson in any way but I do use MOBILedit Forensic in my practice.

I was about to say that lol.

 

 


 

This post was modified 3 years ago by gfshusbandforever

   
ReplyQuote
(@talkybro1)
New Member
Joined: 3 years ago
Posts: 3
 

Thank you !

 

   
ReplyQuote
(@talkybro1)
New Member
Joined: 3 years ago
Posts: 3
 

Thank you for your help. stream videos


   
ReplyQuote
(@alf95)
Eminent Member
Joined: 17 years ago
Posts: 43
 

Hello, here https://theforensicscooter.com/2022/02/21/photos-sqlite-update-3/ you can find Sql queries to execute on photos.sqlite 


   
ReplyQuote
(@ghostanime2001)
Active Member
Joined: 3 years ago
Posts: 5
 

I have the same question. I have 2 iphone 6 which are not jailbroken - one white colour and black colour which belong to my mom and dad. But, Through the years multiple backups were made and now i cant differentiate which photo came from either black or white iphone 6. Is there se identifier for a photo which can link to a device so i know which iphone took the photo ?


   
ReplyQuote
Share: