DFIR Review

Using Photos.sqlite to Show the Relationships Between Photos and the Application they were Created with?

0
Updated
Add to favorites

Research

White papers
  • Apple
  • DFIR Review
  • iOS
  • Mobile
  • Photos
  • SQLite
Tools
  • APOLLO
  • AXIOM
  • Cellebrite Physical Analyzer
  • Cellebrite UFED
  • DB Browser for SQLite
  • Mushy Plist Viewer
  • Navicat for SQLite
  • Zimmerman Hasher
Source
https://dfir.pubpub.org/pub/v19rksyf/release/1

During an examination and analysis, I learned some interesting things and would like to share them with you. After the examination of an Apple iPhone 7, I discovered some photos were captured using the camera application (com.apple.camera.CameraMessagesApp) from within the native iPhone messaging application (com.apple.MobileSMS). As a result of photos being captured, several files were created that I have not observed during my past examinations and I had a few questions.

Attachments

  • File Description
    File Size
    File Type
    Downloads
  • Using Photos.sqlite to Show the Relationships Between Photos and the Application they were Created with
    7 MB
    18

Partners & Sponsors