After recently updating the Photos.sqlite queries I thought it might be time for me to build these queries into the great open-source iLEAPP project. I thought this might be a good way to document how I have converted the queries into iLEAPP parsers, additionally the types of artifacts being parsed using iLEAPP. The parsers areContinue reading “iLEAPP Parsers & Photos.sqlite Queries”
Category Archives: Syndication
Update to Shared with You Syndication Media & Conversation Correlation
This update addresses a question regarding the correlation between Shared with You assets and conversation identifiers in the Apple iOS Photos.sqlite ZGENERICALBUM table. Through testing and research, previously overlooked data in the ZASSET and ZGENERICALBUM tables has provided a method of linking these assets to phone numbers or emails. This join applies to both the Local Photo Library and the Shared with You Syndication Photo Library. More details and updated queries are available on GitHub for further analysis.
Shared with You Syndication Photo Library – Message Attachments & Linked Assets
The Shared with You is a new feature that has been discussed within Apple Worldwide Developers Conference (WWDC) videos and other developer videos. Generally, the comments made indicate that within iOS and other Apple Operating Systems this feature will allow a user to easily view and interact with links that have been shared by otherContinue reading “Shared with You Syndication Photo Library – Message Attachments & Linked Assets”
The Forensic Scooter 