IPhone 7 Screenshots and 5005.jpg File
Can someone help me understand IPhone screenshot artifacts I obtained from an IPhone 7. I have two identical screenshots in two different file locations. Here's an example:
1. Name: 5005.jpg located in file IPhone/var/mobile/Media/PhotoData/Thumbnails/V2/DCIM/100APPLE/IMG_0036.PNG/5005.jpg
2. Name: IMG_0036.PNG locate in file Iphone/var/mobile/Media/DCIM/100APPLE/IMG_0036.PNG
Both files have the same Created and Modified Dates and Times but the PNG file also has a Deleted date and time. Is there anyway to tell whether file number 2 (PNG file) was created on the IPhone 7? Why is there an identical 5005.jpg file for every .PNG screenshot file?
Any help or articles would be greatly appreciated.
One is the thumbnail of the other.
Not necessarily the thumbnail is deleted when the "main" image is.
The 5005.jpg is probably an updated name for 5003.jpg:
Look at the file path for 5005.jpg (../Thumbnails/..). It is a thumbnail for IMG_0036.PNG. I see you have found more images with the same name, but look at the file path of those images. You'll see that they are different.
iPhone saves screenshots as .PNG files so it probably is a screenshot made with an iPhone. Is there any metadata that could point out that the screenshot was taken with an iPhone 7?
I don't think you can prove that it was taken with the exact same phone. But you could be able to point out that it was taken with an iPhone 7 and the device itself is also an iPhone 7.
Thank you for your assistance. Many images have metadata with only the pixel resolution 360x640. One image has metadata with pixel resolution1242x2208, resolution 72x72 (Unit:inch), orientation Horizontal (normal)... I found no metadata on the png images that indicates it was taken with an Iphone 7.
You will have many 5005.jpg, not only one. 5005 is most of the times the generic preview of a picture or a video made with the certain device.