IOS Filenaming conv...
 
Notifications
Clear all

IOS Filenaming convention for Trimmed Videos

Moons
(@moons)
New Member

Hi All,

I am just starting out in Mobile Forensics after previously being exclusively a Computer investigator. 

In one of my recent cases I located videos on an iPhone 11 running IOS 14.0.1 at the following location - private\var\mobile\Containers\Data\PluginKitPlugin\[GUID]\tmp\trim.[guid].mov

After analysing a plist in the root GUID folder, I can see the Plugin being used is the Apple 'PhotoPicker'. I would assume that the files prefixed with 'trim' have been trimmed by the user whilst selecting them through the picker plugin but I was hoping someone had done some testing to confirm this?

Does anyone know if files trimmed by the user are named and cached in this way?

Thanks a lot! 

Quote
Topic starter Posted : 13/04/2021 8:44 am
Share: