In order to improve performance, photos added to the iTunes library are also stored - in form of small thumbnails for quick caching - in the file named "ThumbJPGSegment.data" and maybe also in "Thumb32Segment.data" and "Thumb64Segment.data", all of them located in the "/Users/JohnDoe/Pictures/iPhoto Library/Thumbnails/Segments/" folder.
By analysing a ThumbJPGSegment.data file I see that it contains hundreds of small 128x128 JPG thumbnails of every photo the user opened with iPhoto. Such thumbnails are concatenated sequentially, so they can be carved with common tools such as scalpel. What's relevant to forensic investigation is that thumbnails are not deleted after file removal they just stay there for a long time, some say forever (until you delete the .data files, at least).
Having found images of long time gone important photos has been a good strike, but what I'm looking for is an index - if it exists - of these thumbnails, possibly with some information such as data and known location on disk.
I've searched the web but I found nothing which can extract the information I need. But what I see is a powerful source of evidence for digital investigation on Mac OS devices…
The information might be, I guess, in some .apdb files in the "/Users/JonhDoe/Pictures/iPhoto Library/Database/Properties.apdb" folder. Take "ImageProxies.apdb", "History.apdb" and "Library.apdb" they are sqlite files which contain some kind of references to the cache jpg thumb files stored in the Segment.data files. But I've not found any reference to their internal structure. Fields like "fullSizePreviewChangeDate", "previewFileSize", "miniThumbnailPath" (path contains a date…) make me think that the data I'm looking for is there.
I'd really appreciate suggestions on where to find a software which suits my needs or references to the database structure.
Thanks,
Paolo
P.S. If someone wanted to try and experiment on iPhoto thumb and sqlite files, just google for "ThumbJPGSegment.data" browse through the result pages lots of kind… ehm… inexperienced users are sharing a copy of their iPhoto Library folder. 😉