Hi,
I have extracted an iPhone 5, iOS 8.1.3. On this phone there are two photos found in the following location
Data/mobile/Media/PhotoStreamsData/1327564764/102APPLE/
Using information in Photos.sqlite I found the two keys MSAssetMetadataDeviceID and MSAssetMetadataAssetFileTransferUUID which indicates that the photo was shared with the extracted phone from an account-linked device (although I´m not interlay sure if it´s devices which are linked through Apple-ID or iCloud or iTunes(??) )
The two photos was taken with an iPhone 6 which no longer seem to be linked with any account of the iPhone 5. Is there any way of identifying the actual device which was used to transfer the photos? e.g. Phone name or serial number? Or in any other way identify the iPhone 6.
FYI - The phone is now jailbroken so i have access to a lot more logs and databases.
Any help would be greatly appreciated.