Traces for Deleted photo/video Under Apple Photos app

Read Full blog in PDF

Establishing that a photograph or video was captured at a specific time can be crucial in a criminal investigation, particularly in cases involving offenses such as upskirting. In many instances, by the time officers arrive at the scene or examine a suspect’s device, the relevant photograph or video may already have been permanently deleted.

With modern mobile devices using file-based encryption (FBE), recovering permanently deleted photos or videos can be extremely difficult and, in many cases, may not be possible using current forensic techniques. Apple iPhones also use file-based encryption, presenting similar challenges when attempting to recover deleted media.

However, even when the original photograph or video can no longer be recovered, other forensic traces may remain on the device. These artifacts can potentially provide evidence that a photograph or video was captured at a particular time, even though the media itself has been permanently deleted.

This blog explores forensic traces associated with photos and videos that have been permanently deleted by a user through the Apple Photos app, and how these artifacts may assist investigators in establishing that a capture event occurred.

Conclusion

Even when a photo or video has been permanently deleted and the original media can no longer be recovered, this experiment demonstrates that multiple forensic traces may remainon the device. Importantly, useful evidence may be available even when the acquisition is limited to an iTunes backup, as the Photos.sqlite database and its associated data can provide valuable information about deleted media.
The traces identified during this experiment included evidence of the permanent deletion event, historical information relating to the creation of the media asset, recovered deleted ZASSET records, the original filename, and additional metadata such as camera information.

When these artifacts are correlated, they can help reconstruct the history of a deleted photo or video even when the media itself is no longer available.

A full file system extraction may provide further opportunities to identify supporting evidence from additional sources, including File System Events, Biome, and the Unified Log. Correlating information from these sources with artifacts recovered from Photos.sqlitemay provide an even more complete picture of activity on the device.

The key takeaway for investigators is therefore simple:
where possible, acquire the device as soon as possible. Many of these forensic artifacts are transient and may be automatically purged, overwritten, or otherwise become unavailable over time.

The longer the delay between the relevant activity and acquisition, the greater the possibility that potentially valuable traces will be lost.

Overview of the Apple Photos App

The Apple Photos app is the central location for managing photos and videos across Apple devices, including iPhone, iPad, and Mac. Users can browse, organize, edit, share, and delete photos and videos through the app.

At the heart of the Photos app is the Photos.sqlite database. This is the primary database used to store metadata and organizational information relating to the user’s photo and video library.

From a digital forensic perspective, this database can provide valuable information about media stored on the device and how it has been managed by the user.

Read Full blog in PDF