Part B Filling a device internal storage for Optimize iPhone Storage Research

Part B Filling a device internal storage for Optimize iPhone Storage testing

If you are reading this portion of the write-up about iCloud Photos and Optimize iPhone Storage, congratulations you have fell headfirst into the rabbit hole!! This is a good thing! More than likely, you’re asking yourself questions like why in the heck did he spend so much time testing this stuff and why did he write this crazy long blog about asset optimization.

During the next few sections and example videos, I will detail how I was able to fill Dexter’s iPhone SE internal storage so I could analyze the triggering of Optimize iPhone Storage process. In the middle of doing this research, I realized that to fully capture that moment, I needed to isolate the device from network connections so that I could fill the storage without it automatically optimizing the assets, thus creating more space I needed to fill. I felt like I was chasing my tail.

Prior to isolating the device from networks, Optimize iPhone Storge process occurred a few times. The asset we are analyzing in Part-A, IMG_0043.JPG, optimized prior to isolating the device from the networks, thus moving the original full-sized asset to iCloud Photos. I was not able to catch that exact optimization process to analyze, but I don’t think that matters based on the continued research and testing. When the optimization process occurs, optimized assets and different thumbnails are created on the device internal storge. These assets are covered in both Part-A and within the Photos.sqlite ZINTERNALRESOURCE reference guide.

Starting to fill the local storage & iCloud Photos storage on 10/08/2022

During this research, I wanted to test the device and the Apple Photos application behavior when a device local storage was nearing full. To do this, several assets were captured and imported to the device and synced via iCloud Photos. In figure #1 we can see the starting storage sizes for two different devices using the same Apple ID and the iCloud Photos account:

iCloud Storage 183.79 of 200 available

180 Photos and 57 Videos

iPhone 7 16.4 GB of 128 GB used

Photos App

183 Photos and 58 Videos with Shared with You linked assets

180 Photos and 57 Videos without Shared with You linked assets

iPhone SE 13.3 GB of 32 GB used

Photos App 775 MB

181 Photos and 61 Videos with Shared with You linked assets

180 Photos and 57 Videos without Shared with You linked assets

Note: Initially, the physical devices are displaying different Photo and Video counts. This is due to Shared with You Syndication Photo Library linked assets being displayed in the Photo Library.

To keep track of the newly added assets I have created folders (also known as Parent Albums) and albums to track the assets. Some of the albums have been created then deleted; the creation and deletion of the albums will not be discussed during this write-up.

In figure #1 we will check each devices Photos Application setting to verify that Optimize iPhone Storage is turned on. We again can see detailed in the settings, it states “If your iPhone is low on space, full-resolution photos and videos are automatically replaced with smaller, device-sized versions. Full-resolution versions can be downloaded from iCloud anytime.” See zIntResou-Cloud Last On-Demand Download Date for additional details.

Adding Assets via Drag and Drop 

The first method I used to add assets to the devices was by downloading Google Photo files to a Windows computer, converting the files so that they are compatible for iCloud Photos, then dragging and dropping those assets into iCloud Photos via web browser. You will notice as the assets are uploading to iCloud Photos via the web browser, the devices are syncing at the same time, increasing the device storage size.

iCloud Storage 183.79 of 200 available

216 Photos and 57 Videos

iPhone 7 16.5 GB of 128 GB used

Photos App old unknown / new 419.4 MB

216 Photos and 57 Videos without Shared with You linked assets

iPhone SE 13.3 GB of 32 GB used

Photos App old 775 MB / new 780.2 MB

216 Photos and 57 Videos without Shared with You linked assets

One of the most interesting things I noticed was the device internal storage was only slightly affected by the number and size of the assets that were dragged and dropped into iCloud Photos. The assets were clearly syncing via the connected network, but the device internal storage was barely affected. The iCloud storage was not immediately updated, but it eventually did update. 

Using a third-party tool 3uTools and PicTools to import assets directly into the device 

The second method I used to add assets to the device was by using a few third-party tools, 3uTools and an application named PicTools via a Windows computer. This method imports assets directly onto the device local storage.

iCloud Storage 183.79 of 200 available

iPhone 7 16.6 GB of 128 GB used

Photos App old 419.4 MB / Same

iPhone SE 13.3 GB of 32 GB used

Photos App old 780.2 MB / new 780.3 MB

Figure #2 is a long video that can be referenced to view user and device interactions that were taken to import assets onto the device and into iCloud Photos.

Additional assets imported onto the device and iCloud Photos

In figure #3, we can see the storage sizes and the number of assets associated with the devices and iCloud Photos. Throughout the video, you can see the iPhone SE is syncing/importing assets to iCloud Photos. The device and iCloud storage fluctuates throughout the video. Again, this video is to be used as a reference if you have questions about an asset that is discussed later in the blog.

Large Airdrop file created then received via test devices

In figure #4, we can see the continuation of files being imported into the device and iCloud Photos. We can also observe the device and cloud storage changes as the assets are being imported and synced across the devices.

At 12:13 in figure #4, we can see a video (IMG_0228.MOV) being captured by Dexter’s iPhone SE is stopped. After the video recording was stopped, it was imported into the Local Photo Library and the device internal storage instantaneously.

Follow up on device and iCloud storage sizes – Notification iPhone Storage Full

Figure #5, we will see the asset counts in both devices and iCloud Photos. We can also see the iPhone SE device internal storage size actively changing throughout the video. Please pay special attention to this during the video.

iCloud Storage assets 217 Photos and 158 Videos

iPhone 7 unknown of 128 GB used

Photos App old 419.4 MB / new unknown

217 Photos and 158 Videos

iPhone SE 26.4 GB of 32 GB used

Photos App old 780.3 MB / new 6.6 GB

217 Photos and 158 Videos

We can see at the start of the video the iPhone SE has 26.4 GB of internal storage and the Photos application is using 6.6 GB of that storage.

At 00:22 in figure #5, the device internal storage jumps up to 26.5 GB.

At 00:43 in figure #5, the device internal storage jumps up to 27 GB.

At 1:00 in figure #5, the device internal storage jumps up to 27.5 GB and the Photo application data storage jumps up to 6.64 GB. We can see the last video being displayed on both the iPhone 7 and in iCloud Photos is a video which has an eyeglasses logo on the thumbnail. But the iPhone SE is importing the locally saved asset video of the sunrise.

At 3:15 in figure #5, we can see that after the video has finished uploading and additional assets have been imported into the iPhone SE, the OS starts making decisions on which assets remain on the internal device storage and which assets are being Optimized for iPhone Storage.

At 3:28 in figure #5, a notification is received on the iPhone SE, which indicates the “iPhone Storage Full.” We can then see that the storage for the device is now at 30.6 GB of 32 GB. Notice the date and time in the lower right of the video, 2022-10-09 at 7:53 AM (UTC-7).   

iPhone Storage Full – Optimize iPhone Storage occurs

In figure #6, we can see that the device internal storage is near capacity and 30.6 GB of 32 GB of storage is being used. Optimize iPhone Storage utility/process takes place during the recording of this video. We can see the same notification, iPhone Storage Full, that we observed in the previous video.

iPhone SE 30.6 GB of 32 GB used

Photos App old 6.6 GB / new 6.54 GB

217 Photos and 155 Videos and still importing to iCloud Photos

We then see the device updates and we then have:

iPhone SE 30.6 GB of 32 GB used

Photos App old 6.6 GB / new 6.54 GB

Both devices and iCloud photos have the same number of assets, 217 Photos and 159 Videos.

Then at 01:13 in figure #6, we can see at 9:54 AM (UTC-7), the internal device storage is updated and now indicates the following:

iPhone SE 24.1 GB of 32 GB used

Photos App old 6.54 GB / 6.53 GB

217 Photos and 159 Videos

Notice that the available storage has changed, but the Photos application storage remained the same. I believe this is normal and this is a quick glimpse into the device starting to Optimize iPhone Storage.

You must pay close attention, but within a second or so, the Photos application storage is also updated and is no longer visible on the device screen.

Importing additional assets

I attempted to fill the storage again by importing additional assets. This part of the video was sped up for demonstration purposes. We can see I checked the internal device storage again, with the following results:

iPhone SE 24.3 GB of 32 GB used

Photos App old 6.53 GB / new 172.5 MB

217 Photos and 164 Videos

Notice the storage of the Photos application data is drastically smaller. This is an indication that Optimize iPhone Storage process has taken place.

This is an example that we can watch and see it as it occurs. Normally, we would not have the opportunity to see this in action. If we are lucky, we might have the physical device to validate what we encounter during an examination, others might not be so lucky. Either way, this is something we should all be aware of during our exams.  

Continued monitoring of device storage from Figure #6

We can see the storage is consistently changing and optimizing the media assets to optimize the iPhone storage.

iPhone SE 24.7 GB of 32 GB used

Photos App old 172.5 MB / new 808 MB

217 Photos and 165 Videos

Then: iPhone SE 24 GB of 32 GB used

Notice the time and date in the lower right corner of the screen, it notes that it is 10/9/2022 at 10:52 AM.

Documenting Optimize iPhone Storage process initialized again

In figure #7, on 11/11/2022 at 9:57 AM (UTC-8), Dexter’s iPhone SE with iOS 15.6, does not have a network connection. The device has been in airplane mode for several weeks while I filled the device with additional assets.

We can see, via 3uTools that the device internal storage is near full. We are even getting a notification that the device storage is full. Based on the data from 3uTools, 29.29 GB of 29.77 hard disk space is being used and 22.94 GB of 23.43 GB of user storage is being used, leaving 496.46 MB of storage available. Using the Realtime Screen tool we can see the device is in airplane mode and only Bluetooth is turned on. Within the device settings, on 11/11/2022 at 9:57 AM, the device storage is indicating the following:

iPhone SE 31.7 GB of 32 GB is being used

Photos App is using 14.2 GB of storage

239 Photos and 196 Videos are within the local photo library

Notice the size of the Photos (Yellow) portion of the storage bar scale. It takes up almost 50% of the bar. This will change after optimization occurs.

Notice that Yours & Shared setting is ON. I will turn this OFF to see how this affects the counts. Now its indicating 238 Photos and 191 Videos are within the local photo library. This is due to the Shared with You Syndication Photo Library linked assets.

Notice the last few videos being displayed in the Photo Library. Because this device has not been connected to a network these assets have not been synced with iCloud Photos. We can see within the settings that iCloud Photos is ON and Optimize iPhone Storage setting is ON.

When we view iCloud Photos via an internet browser, we can see that those large videos have not been synced and are not in iCloud Photos.

Using 3uTools we can see their breakdown of the assets being stored locally on the device. I clicked on one of the assets (IMG_0293.MOV) and it loaded the file.

The device was acquired using different forensics tools. During one of the acquisitions, we can see it indicates the device storage is full. After the device acquisitions were made, their sizes were larger than 32 GBs, some were more than 50 GBs in size.  

On 11/13/2022 the device was connected to a network and the Local Photo Library assets started syncing with iCloud Photos. As most of you know, this can take several hours/days if you have large files to sync. During this process, I refreshed the storage several times to see if there were any changes. It appeared the large files were taking longer than expected to sync. I deleted a few of the larger assets to speed up the process. On 11/14/2022 at approximately 2:00 PM (UTC-8) the assets stored on the device finished syncing with iCloud Photos.

Almost immediately after the assets were completely synced with iCloud Photos, Optimized iPhone Storage process occurred, and significant changes were made to the internal local storage. After the device optimized its assets, additional free space was made available.

After syncing with iCloud Photos, the device UI indicated the following:

• Internal storage went from 26.7 GB to 25.6 GB of data
• Photos Application data went from 8.17 GB to 125.4 MB

Additional things to take notice of:

• There appears to be a large amount of system data as noted within the device UI
• During the acquisition you can see another mention of this system data listed as “Other” data

The device was acquired very quickly after the optimization occurred. Notice the size difference of the data being used in the Photos application before optimization (8.17 GB) and after optimization (125.4 MB).

Use this link to review the full write-up: Did you find a Full-Sized Asset or a Thumbnail? Optimize iPhone Storage and iCloud Photos

Use this link to review the Reference Guide: Photos-sqlite zInternalResource table Reference Guide