- Nationwide Digital Forensic & Cyber Services
- BOOK A FREE CONSULTATION TODAY!
Independent forensic analysis of iOS Photos — Photos.sqlite catalog, EXIF and file-system metadata, HEIC/HEVC/Live Photos, Recently Deleted, and iCloud Photos sync — with recovery of deleted media from database WAL, unallocated media, and prior backups.
Quick Answer. iPhone photos live under /private/var/mobile/Media/DCIM/ and are cataloged in Photos.sqlite at /private/var/mobile/Media/PhotoData/Photos.sqlite. Every asset has a ZASSET row with capture date, GPS coordinates, creator device, edit history, album membership, and Recently Deleted state. Deleted assets remain in Recently Deleted for 30 days and thereafter remain recoverable via WAL, unallocated media, and iCloud sync tombstones.
| Table | Contents |
|---|---|
| ZASSET | Each photo/video: filename, capture date, GPS, device, edit state, trashed flag |
| ZADDITIONALASSETATTRIBUTES | Original filename, exif orientation, creator bundle-id |
| ZDETECTEDFACE / ZPERSON | Face detection and named person tags (People album) |
| ZGENERICALBUM / ZALBUMLIST | Albums, memories, shared albums |
| ZMOMENT / ZMOMENTLIST | Time+place clustering |
| ZCLOUDSHAREDALBUM* | iCloud Shared Album participation |
| ZASSET.ZTRASHEDSTATE | 0=live, 1=recently deleted, ZTRASHEDDATE = deletion time |
iOS captures HEIC/HEVC with full EXIF: capture time, camera model, lens, ISO, GPS latitude/longitude/altitude, orientation, and — critically — a stable per-device CameraOwnerName and Software string that identifies the exact iOS build. We compare EXIF to ZASSET to detect tampering (edits, re-saves, re-encodes) and to distinguish media captured on the device from media received from third parties.
A Live Photo is a paired .HEIC still and .MOV motion file sharing an AssetIdentifier. Portrait mode stores a depth map. Slo-mo videos embed rate-change markers. These pairings are decisive in tampering claims — deleting only the still while leaving the motion, or vice versa, is a strong indicator of manual manipulation rather than normal deletion.
ZASSET.ZTRASHEDSTATE = 1, still on diskPhotos.sqlite — pre-deletion stateTo prove a photo was taken on the subject device we look for: EXIF CameraOwnerName matching the device Apple ID, Software matching an iOS build known to have been installed on the device, image sensor characteristics consistent with the device model, a matching ZASSET row created by com.apple.mobileslideshow (Camera app), and a corresponding KnowledgeC /app/inFocus Camera session at capture time. Missing any of these does not disprove authorship, but presence of all is conclusive.
Elite Digital Forensics is an independent, defense-aligned iPhone forensics practice. We are retained by attorneys, in-house counsel, and, where appropriate, individuals and businesses directly. Every engagement begins with a scoped acquisition plan, hash-verified evidence, and a written report suitable for attorney review, negotiation, or court. When retained through counsel, our work product is protected. See the iPhone Forensics hub for the full analytical framework we bring to every matter.
Often — via WAL, unallocated-space carving, and any pre-deletion backup or iCloud snapshot.
iOS preserves the original and stores adjustments in a sidecar; ZASSET.ZHASADJUSTMENTS = 1 marks edited assets and originals remain retrievable.
App-level exports can produce spoofed EXIF, but on-device HEIC captured directly by Camera.app is signed with device characteristics that are extremely difficult to synthesize.
Screenshots have distinctive filename patterns and no camera EXIF; ZASSET.ZKINDSUBTYPE = 2 flags them.
Tell us about the Mac, the accounts, and the timeframe. We will tell you what is recoverable, what is not, and what it will cost.
Request Confidential Consultation Call (833) 292-3733This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic services and expert witness testimony; we do not provide legal representation. Every case is fact-specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder