Photos.sqlite Query Documentation & Notable Artifacts

As many of you are aware, I recently updated my Photos.sqlite queries. Since releasing the different query iterations, I have received several questions about how I was able to decode the data included in the queries. That’s a great question! I also noticed several questions being posted to the listservs and DFIR Discord about theContinue reading “Photos.sqlite Query Documentation & Notable Artifacts”

Photos.Sqlite Queries – Update

I would like to start off by saying thank you to everyone who has reached out about the Photos.sqlite queries I previously posted. After chatting with some people who have used the queries, it was suggested that I update the queries to include the following: Restructuring the query output Renaming and clarifying the column namesContinue reading “Photos.Sqlite Queries – Update”