During an examination and analysis, I learned some interesting things and would like to share them with you. After the examination of an Apple iPhone 7, I discovered some photos were captured using the camera application (com.apple.camera.CameraMessagesApp) from within the native iPhone messaging application (com.apple.MobileSMS). As a result of photos being captured, several files were created that I have not observed during my past examinations and I had a few questions.

Using Photos.sqlite to Show the Relationships Between Photos and the Application they were Created with?
0
Updated
Research
White papers
- Apple
- DFIR Review
- iOS
- Mobile
- Photos
- SQLite
Tools
- APOLLO
- AXIOM
- Cellebrite Physical Analyzer
- Cellebrite UFED
- DB Browser for SQLite
- Mushy Plist Viewer
- Navicat for SQLite
- Zimmerman Hasher
{{#ratings}}
{{title}}
{{#ownerCreatedBlock}}
{{/ownerCreatedBlock}}
{{#category}}
{{#editor}}
{{/editor}}
{{#user}}
{{/user}}
{{/ratings}}
-
{{#owner}}
-
{{#url}}
{{#avatarSrc}}
{{/avatarSrc}} {{^avatarSrc}} {{& avatar}} {{/avatarSrc}}{{name}} {{/url}} {{^url}} {{#avatar}} {{& avatar}} {{/avatar}} {{name}} {{/url}} - {{/owner}} {{#created}}
- {{created}} {{/created}}
Category: {{category.title}}
{{/category}}
{{#fields}}
{{#showLabel}}
{{/fields}}
{{label}}:
{{/showLabel}}
{{& text}}