Quantcast
Channel: Forensic Focus Forums - Recent Topics
Viewing all articles
Browse latest Browse all 20107

Mobile Phone Forensics: 5003.jpg and iOS file system

$
0
0
topsirloin wrote: Each image within the DCIM folder appears to have another image named 5003.jpg embedded within itself in the Photodata folder. Could you confirm the full file path? Off the top of my head, I believe the 5003.jpg file is a thumbnail of the original picture file that is mentioned within it's file path. Photodata folder contains db files/thumbnails of files located within DCIM. I have had quite a few recently (using Cellebrite & XRY) that have been extracted from the Photo stream folder, within the following location: /private/var/mobile/Media/PhotoData/Thumbnails/V2/PhotoStreamsData/100APPLE/<IMG_xxxx.jpg>/5003.jpg Or something like that path, i'll check when back in office. topsirloin wrote: I'm finding if I need to generate a PDF image report, it is taking many times longer than usual. Is anyone else experiencing this? Yes, now I am resorting to only providing what data the OIC has requested. Once you have opened up the Images tab at the top of PA, view the picture files via folder structure instead of the usual thumbnails/list view. Then only select the relevant folders to export, i.e. exclude predefined folders and select the obvious, i.e. DCIM (1st gen and stored pictures), chat attachment folders etc. Might save you a bit of processing time and a headache hunting through the default files installed via applications etc.

Viewing all articles
Browse latest Browse all 20107

Trending Articles