Hi All,
I have a query regarding an iPhone 5 running IOS 7.0.4
I have some images named IMG_#### (random numbers) These are within the DCIM 108APPLE folder. However, these pictures have not been taken by this phone. They are 'potentially' screenshots. However I have my severe doubts, because
1. They are not PNGs. They are JPEGS. From my experience IOS screenshots are PNGs
2. There is a reference to WhatsApp (com.apple.assetsd.creatorBundleID), however these pictures are not in any of the recovered WhatsApp Media?
I'm a little stumped to how they have got on this device?
Were they WhatsApp'd and deleted (if so why are they called IMG_####) if they are screen shots, why not PNGs?
If they were "saved" from a location (e.g. internet) why the reference to WhatsApp in the file info.
There is no EXIF data from the images. All very confusing.
Oh… Phone downloaded with CelleBrite/Physical Analyser
Any ideas much appreciated.
Thanks.
4R
They are thumbnails of the Iphone's pictures.
I can't see how. There are already 2 of each of them. One states its a thumbnail and is named 5003.JPG.
The IMG file is a larger file (in both size and quality)
Is IOS doing something else? Is there another copy of this file, which in this case would make 2 thumbnails, one IMG and one 5003 of another file?
I'm confused! ?
May be they are pictures received by the user via WhatsApp and saved to his/her camera roll?
Yes thats a theory we are working with. They are not in the WhatsApp, but its not our of the realm of reality that those messages have been deleted.
Thanks,