iOS photos.sqlite a...
 
Notifications
Clear all

iOS photos.sqlite and deleted photos

1 Posts
1 Users
0 Likes
2,602 Views
(@mrmdataservices)
Posts: 2
Active Member
Topic starter
 

Hi all,

Thanks for taking my question. Brand new to this forum.

I have an iTunes backup of an iPhone 7 running iOS 12.1.4. What I need to know is whether any pictures were taken on a certain day. No pictures currently exist in the Photos app or the trash folder for the day in question.

So far I've read a very helpful blog post at https://www.forensicmike1.com/2019/05/02/ios-photos-sqlite-forensics/ for some direction.

I have extracted the photos.sqlite database and run the following query:

Select Z_PK, ZDATECREATED, ZFILENAME from ZGENERICASSET

where Z_PK corresponds with RowID.

From the results of this query, I can see an entry from the day before the date in question with a Z_PK of 3190. The next entry is three days after the date in question, with a Z_PK of 3195.

Based on my prior experience with SQLite, I feel like I can conclude from this that four photos were created during the four day window that includes my date of interest, and have since been deleted. Does anyone have experience analyzing photos.sqlite that can give me some assurance or other guidance?

 

This topic was modified 2 years ago by MRMDataServices
 
Posted : 05/05/2022 5:23 pm
Share: