Blog

Do you have a Full-Sized Asset…or just a Thumbnail? Did Optimized iPhone Storage process occur?

Hello everyone! During previous research, I’ve mentioned a few times that my test devices were using the Apple Photos application setting Optimize iPhone Storage in lieu of Download and Keep Originals setting. I’ve used this setting in the past because most devices I’ve encountered are using this setting. I’ve always had a curiosity about theContinue reading “Do you have a Full-Sized Asset…or just a Thumbnail? Did Optimized iPhone Storage process occur?”

Part B Filling a device internal storage for Optimize iPhone Storage Research

Part B Filling a device internal storage for Optimize iPhone Storage testing If you are reading this portion of the write-up about iCloud Photos and Optimize iPhone Storage, congratulations you have fell headfirst into the rabbit hole!! This is a good thing! More than likely, you’re asking yourself questions like why in the heck didContinue reading “Part B Filling a device internal storage for Optimize iPhone Storage Research”

Photos.sqlite ZINTERNALRESOURCE Table Reference Guide

This reference guide was built as a part of some research and testing I performed looking into the Photos.sqlite ZINTERNALRESOURCE table. During the research, I was able to interpret most of the values I encountered, but I was not able to decode everything. Additional research and testing are required. I will continue to update thisContinue reading “Photos.sqlite ZINTERNALRESOURCE Table Reference Guide”

Shared with You Syndication Photo Library – Message Attachments & Linked Assets

The Shared with You is a new feature that has been discussed within Apple Worldwide Developers Conference (WWDC) videos and other developer videos. Generally, the comments made indicate that within iOS and other Apple Operating Systems this feature will allow a user to easily view and interact with links that have been shared by otherContinue reading “Shared with You Syndication Photo Library – Message Attachments & Linked Assets”

Local Photo Library Photos.sqlite Query Documentation & Notable Artifacts

As many of you are aware, I recently updated my Photos.sqlite queries. Since releasing the different query iterations, I have received several questions about how I was able to decode the data included in the queries. That’s a great question! I also noticed several questions being posted to the listservs and DFIR Discord about theContinue reading “Local Photo Library Photos.sqlite Query Documentation & Notable Artifacts”

Local Photo Library Photos.sqlite Query Variations & WHERE statements

I would like to start off by saying thank you to everyone who has reached out about the Photos.sqlite queries I previously posted. After chatting with some people who have used the queries, it was suggested that I update the queries to include the following: To do this, I used data from multiple devices andContinue reading “Local Photo Library Photos.sqlite Query Variations & WHERE statements”

Photos.sqlite Queries – Original Blog Posting

Hello everyone! Back in August 2020, I wrote a blog “Using Photos.Sqlite to show the relationships between photos and the application they were created with?” which was posted on Heather Mahaliks’ blog, https://smarterforensics.com/. The writeup was eventually sent to DFIR Review (https://dfir.pubpub.org/pub/v19rksyf/release/1) and published on their website. This is a follow-up to the aforementioned blogContinue reading “Photos.sqlite Queries – Original Blog Posting”

Loading…

Something went wrong. Please refresh the page and/or try again.


Follow My Blog

Get new content delivered directly to your inbox.