IPhone 7 Screenshot...
 
Notifications
Clear all

IPhone 7 Screenshots and 5005.jpg File

kgray13
(@kgray13)
New Member

Can someone help me understand IPhone screenshot artifacts I obtained from an IPhone 7.  I have two identical screenshots in two different file locations.  Here's an example:

1.  Name: 5005.jpg located in file  IPhone/var/mobile/Media/PhotoData/Thumbnails/V2/DCIM/100APPLE/IMG_0036.PNG/5005.jpg

2.  Name: IMG_0036.PNG locate in file Iphone/var/mobile/Media/DCIM/100APPLE/IMG_0036.PNG

Both files have the same Created and Modified Dates and Times but the PNG file also has a Deleted date and time.  Is there anyway to tell whether file number 2 (PNG file) was created on the IPhone 7?  Why is there an identical 5005.jpg file for every .PNG screenshot file?  

Any help or articles would be greatly appreciated.  

 

Quote
Topic starter Posted : 30/10/2020 2:58 pm
jaclaz
(@jaclaz)
Community Legend

One is the thumbnail of the other.

Not necessarily the thumbnail is deleted when the "main" image is.

See:

https://apple.stackexchange.com/questions/136102/photo-thumbnails-remain-in-camera-roll-after-moving-photos-to-computer

The 5005.jpg is probably an updated name for 5003.jpg:

https://www.forensicfocus.com/forums/mobile-forensics/5003-jpg-and-ios-file-system/

jaclaz

ReplyQuote
Posted : 31/10/2020 12:19 pm
roope
(@roope)
New Member

Look at the file path for 5005.jpg (../Thumbnails/..). It is a thumbnail for IMG_0036.PNG. I see you have found more images with the same name, but look at the file path of those images. You'll see that they are different.

iPhone saves screenshots as .PNG files so it probably is a screenshot made with an iPhone. Is there any metadata that could point out that the screenshot was taken with an iPhone 7?

I don't think you can prove that it was taken with the exact same phone. But you could be able to point out that it was taken with an iPhone 7 and the device itself is also an iPhone 7.

ReplyQuote
Posted : 01/11/2020 5:46 pm
kgray13
(@kgray13)
New Member

Thank you for your assistance.  Many images have metadata with only the pixel resolution 360x640.  One image has metadata with pixel resolution1242x2208, resolution 72x72 (Unit:inch), orientation Horizontal (normal)... I found no metadata on the png images that indicates it was taken with an Iphone 7.

ReplyQuote
Topic starter Posted : 03/11/2020 2:09 pm
passcodeunlock
(@passcodeunlock)
Senior Member

You will have many 5005.jpg, not only one. 5005 is most of the times the generic preview of a picture or a video made with the certain device.

ReplyQuote
Posted : 14/12/2020 9:26 pm
Share: