Currently using Cellebrite UFED Classic and Physical Analyzer v. 3.9.5.192.
I performed a file system extraction via the UFED Classic on an iPhone 5s. The trouble I'm running into is that a particular photo appears in the iPhone's "Moments" view on a date in 2011, however Cellebrite does not seem to contain a creation date within the AFC. The Backup service has a creation date of 2013. It does not appear that the picture was taken on this iPhone. It also appears as though the picture was received via a sync from iTunes. My question is this: Why is it that the photo appears on the device's camera roll with a date in 2011, but there is no record of the photo and that year within the forensic image?
Any help would be much appreciated!
↧