Hello everyone, I hope you are well.
I've to analyze a FFS of an iPhone 7 IOS 13.3.1
Â
During the analysis, I find a interesting picture, and I'd like to know if this picture has been taken from this iPhone
- The name of the photo is : IMG_0262.JPG
- She is store in : root/private/var/mobile/Media/DCIM/100APPLE/IMG_0262.JPG
- I can see it on a Gallery album called "Snapchat"
- I don't have any EXIF
-I find some references about this pictures in Photo.sqlite (Table: ZGENERICASSET(Z_PK: 276))
Â
It is often said, "photos from the device's camera will reside in the DCIM directory.", but what if user copied a picture find on snapchat into that path ?
Â
Is there any solution to know if a picture has been taken from this device if I don't have any EXIF ?
Â
Thank you for your help.
Â
Compelson's Camera Ballistics tool may meet your needs:
Â
https://www.mobiledit.com/camera-ballistics
NOTE:Â I am not professionally associated with Compelson in any way but I do use MOBILedit Forensic in my practice.
Thank you !
Compelson's Camera Ballistics tool may meet your needs:
Â
https://www.mobiledit.com/camera-ballistics
NOTE:Â I am not professionally associated with Compelson in any way but I do use MOBILedit Forensic in my practice.
I was about to say that lol.
Â
Â
Â
Thank you !
Hello, here https://theforensicscooter.com/2022/02/21/photos-sqlite-update-3/ you can find Sql queries to execute on photos.sqliteÂ
I have the same question. I have 2 iphone 6 which are not jailbroken - one white colour and black colour which belong to my mom and dad. But, Through the years multiple backups were made and now i cant differentiate which photo came from either black or white iphone 6. Is there se identifier for a photo which can link to a device so i know which iphone took the photo ?
