How to know if a pi...
 
Notifications
Clear all

How to know if a picture has been taken from this Apple device ?

8 Posts
6 Users
0 Likes
2,937 Views
(@eilco)
Posts: 12
Eminent Member
Topic starter
 

Hello everyone, I hope you are well.

I've to analyze a FFS of an iPhone 7 IOS 13.3.1

 

During the analysis, I find a interesting picture, and I'd like to know if this picture has been taken from this iPhone

- The name of the photo is : IMG_0262.JPG

- She is store in : root/private/var/mobile/Media/DCIM/100APPLE/IMG_0262.JPG

- I can see it on a Gallery album called "Snapchat"

- I don't have any EXIF

-I find some references  about this pictures in Photo.sqlite (Table: ZGENERICASSET(Z_PK: 276))

 

It is often said, "photos from the device's camera will reside in the DCIM directory.", but what if user copied a picture find on snapchat into that path ?

 

Is there any solution to know if a picture has been taken from this device if I don't have any EXIF ?

 

Thank you for your help.

 

 
Posted : 15/02/2022 5:14 pm
UnallocatedClusters
(@unallocatedclusters)
Posts: 577
Honorable Member
 

Compelson's Camera Ballistics tool may meet your needs:

 

https://www.mobiledit.com/camera-ballistics

NOTE:  I am not professionally associated with Compelson in any way but I do use MOBILedit Forensic in my practice.

 
Posted : 15/02/2022 6:11 pm
(@eilco)
Posts: 12
Eminent Member
Topic starter
 

Thank you !

 
Posted : 16/02/2022 8:08 am
(@gfshusbandforever)
Posts: 6
Active Member
 
Posted by: @unallocatedclusters

Compelson's Camera Ballistics tool may meet your needs:

 

https://www.mobiledit.com/camera-ballistics

NOTE:  I am not professionally associated with Compelson in any way but I do use MOBILedit Forensic in my practice.

I was about to say that lol.

 

 


 

This post was modified 2 years ago by gfshusbandforever
 
Posted : 28/02/2022 3:51 pm
(@talkybro1)
Posts: 3
New Member
 

Thank you !

 
 
Posted : 22/03/2022 12:14 pm
(@talkybro1)
Posts: 3
New Member
 

Thank you for your help. stream videos

 
Posted : 23/03/2022 7:38 am
(@alf95)
Posts: 43
Eminent Member
 

Hello, here https://theforensicscooter.com/2022/02/21/photos-sqlite-update-3/ you can find Sql queries to execute on photos.sqlite 

 
Posted : 30/03/2022 2:18 pm
(@ghostanime2001)
Posts: 5
Active Member
 

I have the same question. I have 2 iphone 6 which are not jailbroken - one white colour and black colour which belong to my mom and dad. But, Through the years multiple backups were made and now i cant differentiate which photo came from either black or white iphone 6. Is there se identifier for a photo which can link to a device so i know which iphone took the photo ?

 
Posted : 10/02/2024 8:15 pm
Share: