IOS Filenaming convention for Trimmed Videos
I am just starting out in Mobile Forensics after previously being exclusively a Computer investigator.
In one of my recent cases I located videos on an iPhone 11 running IOS 14.0.1 at the following location - private\var\mobile\Containers\Data\PluginKitPlugin\[GUID]\tmp\trim.[guid].mov
After analysing a plist in the root GUID folder, I can see the Plugin being used is the Apple 'PhotoPicker'. I would assume that the files prefixed with 'trim' have been trimmed by the user whilst selecting them through the picker plugin but I was hoping someone had done some testing to confirm this?
Does anyone know if files trimmed by the user are named and cached in this way?
Thanks a lot!
Posted : 13/04/2021 8:44 am