Hi,
i a case of murder I investigate an iPhone 5s and found some small (3-100 KB) JPEG-pictures (from FB-Profiles and Photo Albums) in
/private/var/mobile/Applications/com.facebook.Facebook/Library/Caches/_store_[…]_7.1_iphone_[…]_de_de_DE/FBDiskCache/1/FBImageDownloader-[…].jpeg
I need some details about the creation of these files. Maybe you could help me with the questions
1. Are those Pics cached automatically when a user opens a facebook-profile or album?
2. Could those Pics be "prefetched" without the user wanting it? Is it possible or even usual, that the facebook-app preloads content/pics before a user clicked on a friendlist, album, etc.?
3. Have those Pics be clicked-on by the user?
4. When does the Facebook-App refresh/overwrite those pics?
I googled a lot and read in the iOS Forensic Analysis and iPhone Forensic Analysis books. I tried to read & understand the code of the Facebook-App, but don't have any coding skills.
If you want to contact me via LE-approved non-public channels, please drop me a line. Otherwise I am thankful for useful comments.
Thanks,
Carsten