IOS Filenaming convention for Trimmed Videos

General (Technical, Procedural, Software, Hardware etc.)

Last Post by Moons 3 years ago

1 Posts

1 Users

0 Reactions

3,134 Views

RSS

Moons

(@moons)

New Member

Joined: 3 years ago

Posts: 2

Topic starter 13/04/2021 8:44 am

Hi All,

I am just starting out in Mobile Forensics after previously being exclusively a Computer investigator.

In one of my recent cases I located videos on an iPhone 11 running IOS 14.0.1 at the following location - private\var\mobile\Containers\Data\PluginKitPlugin\[GUID]\tmp\trim.[guid].mov

After analysing a plist in the root GUID folder, I can see the Plugin being used is the Apple 'PhotoPicker'. I would assume that the files prefixed with 'trim' have been trimmed by the user whilst selecting them through the picker plugin but I was hoping someone had done some testing to confirm this?

Does anyone know if files trimmed by the user are named and cached in this way?

Thanks a lot!

Quote

Topic Tags