First time poster, long time lurker. ON to the question.
Is there a way to show the true creation time of a photo within iPhone? A victim reset her phone and there are photos that show creation times that predate the reset. She claims they were resent to her after the reset via different methods (SMS, Airdrop, etc). However, I am having trouble replicating this.
I've done the factory reset. When I import photos back onto the iPhone using various methods (icloud, sms, airdrop, connecting to a Mac) all my creation times show the creation date they were introduced onto the phones filesystem. Ex. A photo taken in March now shows a creation time of today's date. Is there a way to keep the March date?
The capture times are showing true and correct because of the metadata.
At this point I'm trying to corroborate or disprove that this is even possible.
I"m using Cellebrite PA .
MacOSX and iOS tend to embed many different types of extended attributes and those may contain some of the information you are looking for.
Try this
xattr -xl filename.extension
Some interesting attributes would be
com.apple.metadatakMDItemWhereFroms
com.apple.quarantine
Reference
https://
http//
http//
Hope this helps.
Cheers!
you can also have a look at Exifgui tool to check any other information available in the header.
I recently used a free program called MediaInfo. It is really fast and has various ways to look at and export the data.
The Creation date on IOS is most likely the File Inode change date/time. I've seen this in for example exporting photo's from of the cloud to the phone.
Check the photo with exiftool. You will most likely see attributes like Date/Time original and/or Create date
Also PA should parse this timestamp actually..
https://