Not sure if this existed pre-iOS7, but I'm seeing this more and more lately. Many of the iPhone reports within Cellebrite PA are becoming cumbersome to generate if they include many images. Each image within the DCIM folder appears to have another image named 5003.jpg embedded within itself in the Photodata folder.
I'm finding if I need to generate a PDF image report, it is taking many times longer than usual. Is anyone else experiencing this? Does anyone know the significance of the 5003.jpg file? I've tried to find documentation online about it without any luck.
Each image within the DCIM folder appears to have another image named 5003.jpg embedded within itself in the Photodata folder.
Could you confirm the full file path? Off the top of my head, I believe the 5003.jpg file is a thumbnail of the original picture file that is mentioned within it's file path. Photodata folder contains db files/thumbnails of files located within DCIM. I have had quite a few recently (using Cellebrite & XRY) that have been extracted from the Photo stream folder, within the following location
/private/var/mobile/Media/PhotoData/Thumbnails/V2/PhotoStreamsData/100APPLE/<IMG_xxxx.jpg>/5003.jpg
Or something like that path, i'll check when back in office.
I'm finding if I need to generate a PDF image report, it is taking many times longer than usual. Is anyone else experiencing this?
Yes, now I am resorting to only providing what data the OIC has requested. Once you have opened up the Images tab at the top of PA, view the picture files via folder structure instead of the usual thumbnails/list view. Then only select the relevant folders to export, i.e. exclude predefined folders and select the obvious, i.e. DCIM (1st gen and stored pictures), chat attachment folders etc. Might save you a bit of processing time and a headache hunting through the default files installed via applications etc.
You are spot on with the path. That is exactly it.
Unfortunately sometime's I'm required to provide it all, so I will need to just sit through the long wait times, but in when I'm in a timecrunch and I know the images in the photodata aren't relavent, I will follow your suggestion and exclude them.
I'm glad to see I'm not the only one that is experiencing this! I thought it was just me.
Thanks!
only noticed it recently when I was asked to look into the EXIF data on a picture file (5003.jpg) and it soon became apparent there were thousands of these thumbnails with the same file name… I thought I had lost the plot for a second!
I would be careful though, as if lets say the original picture file located within DCIM is deleted, sometimes the thumbnail will still reside within the Photodata location, therefore it can still be very useful to export these as well as they can still be good evidence. I only tend to exclude preloaded/default app related files, this at least helps a little with the quantity/time aspect. )
These are thumbnails, but I have had instances where thumbnails of deleted images/videos remain and have changed a negative case to a positive.