All,
Does somebody know what digital camera or mobile device uses the below naming convention for images taken with the device in question?
IMG-20170407-WA0007_resized.jpg / IMG-20170407-WA0007.jpg
There is no usable meta data in these files and neither of the generally known devices appear to use this naming schema.
Thanks!
Rg,
Lex
These are WhatsApp images imported/downloaded usually to <storagenode>/WhatsApp/Media/WhatsApp Images/. According to this naming convention, you find tons of exported collections on the internet, also containing memes and screen shots, so definitely not a camera specific name.
However, most of the pictures that I had a quick look at actually do contain meta data from smartphone cameras. I guess, these are locally taken pictures which are stripped for sending, and the blank ones are either received or edited.
Hello C.R.S.,
Thanks a lot this really helps!
Concerning the date related data in these file names, do these still refer to the date the photo was taken or does it refer to the date the image was sent through WhatsApp?
Rg,
Lex
You should really check this on a live WhatsApp installation, to be sure. I'm not an expert in mobile forensics, but throw such questions into our OSINT solution. From there I can tell for images which are available on the internet, that camera meta data (if existent) and the date in the file name are consistent. But this may result from people's tendency to take a picture immediately before they send it. Just from the software engineering standpoint, I doubt that WA names its media cache files according to meta data/the date when the picture was taken, but will use the date when the picture is handled by WA itself.
Hello C.R.S.,
Thanks again for your feedback.
I did a limited test already (1 iOS and 1Android) and it is indeed the date the pictures were taken.
WA just appends the WAxxxx_resized.jpg to the original filename.
Of course this might be camera or even version dependent.
Rg,
Lex