- Nationwide Digital Forensic & Cyber Services
- BOOK A FREE CONSULTATION TODAY!
Independent forensic analysis of Android media — DCIM camera storage, MediaStore external.db, Google Photos cloud, EXIF and video container metadata, thumbnails, and the 60-day Trash — with authenticity analysis and deleted-media recovery.
Quick Answer. Android media lives across three layers. On-disk: /storage/emulated/0/DCIM/ for camera captures and /Pictures/, /Movies/, /Download/ for received/downloaded media, plus per-app /Android/media/<pkg>/ for app media (WhatsApp, Signal). Provider layer: MediaStore external.db at /data/data/com.android.providers.media/databases/external.db indexes every asset with size, mime, date_added, date_modified, latitude/longitude, is_trashed, and is_pending. Cloud layer: Google Photos backs up on-account with 60-day Trash retention. Deleted media routinely survives via MediaStore trash, Google Photos, thumbnails, and app copies.
| Column / Table | Contents | Forensic value |
|---|---|---|
| files (unified) | _id, _data, _display_name, mime_type, size, date_added, date_modified, date_taken, latitude, longitude, is_trashed, is_pending, is_favorite, owner_package_name | One row per visible file with GPS, ownership, trash state |
| thumbnails / video_thumbnails | image_id / video_id, _data, kind, width, height | Thumbnail references that outlive the original |
| audio, images, video (views) | Filtered projections of files | Per-media-type schema for legacy apps |
| External SD-card volume | Separate external_ | Removable-media evidence tied to a specific SD card |
Camera captures land in /storage/emulated/0/DCIM/Camera/ with the file name typically YYYYMMDD_HHMMSS.jpg in device local time. Thumbnails live under /storage/emulated/0/DCIM/.thumbnails/ (deprecated but still generated by many OEM camera apps). Since Android 11, deleted media that has been moved to the MediaStore Trash is renamed to .trashed-<expires_ms>-original.ext and kept for 30 days — trivially recovered by renaming the file back.
We hash every asset and extract full EXIF (make/model/lens, focal length, ISO/aperture, timestamp with sub-second, GPS lat/long/altitude, orientation), XMP sidecars, and video container atoms (MP4 moov, udta, GPS trak, Samsung SEFT, HEIF infe/iref). Cross-checking EXIF timestamp against MediaStore date_modified and file-system mtime detects tampering (edited or renamed originals). See Android Timeline Reconstruction for how we correlate.
Google Photos backs up images and videos to the Google account (opt-in). The client maintains state under /data/data/com.google.android.apps.photos/. Deleted assets move to the account’s Trash for 60 days and are then permanently deleted. Assets removed from the device but retained in the cloud are examined via Takeout with authorization. Every asset in Google Photos preserves original EXIF, backup timestamp, and albums.
Received media on WhatsApp lives at /storage/emulated/0/Android/media/com.whatsapp/WhatsApp/Media/ with subfolders per type. Sent media is stored in the same tree plus Sent/ subfolders. Signal keeps encrypted attachments under /data/data/org.thoughtcrime.securesms/app_parts/ with row references in signal.db. Snapchat writes to /data/data/com.snapchat.android/cache/. Each of these is a separate media store we enumerate independently.
.trashed-* files..thumbnails/, MediaStore thumbnails table, and per-app thumbnail caches persist after the original is gone.Elite Digital Forensics is an independent, defense-aligned Android forensics practice. We are retained by attorneys, in-house counsel, and, where appropriate, individuals and businesses directly. Every engagement begins with a scoped acquisition plan, hash-verified evidence, and a written report suitable for attorney review, negotiation, or court. When retained through counsel, our work product is protected. See the Android Forensics hub for the full analytical framework we bring to every matter.
By matching EXIF make/model/lens/serial to the device model, checking sensor pattern noise (PRNU), verifying MediaStore ownership, and correlating capture time with UsageStats camera-in-foreground events.
Frequently, from unallocated space (with root/physical), from cloud (Google Photos ended 60-day retention but archives may exist), from thumbnails, and from app copies (received media on messaging apps).
The item leaves user access. Google’s internal retention practices are not publicly guaranteed beyond the 60-day Trash. Preservation letters submitted before the 60-day window are the safest path.
The .nomedia sentinel hides a folder from MediaStore, but files remain on disk and are trivially discovered by forensic tools. Vault apps store re-encrypted copies in their own containers — examined per-app.
Tell us about the device, the accounts, and the timeframe. We will tell you what is recoverable, what is not, and what it will cost.
Request Confidential Consultation Call (833) 292-3733This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic services and expert witness testimony; we do not provide legal representation. Every case is fact-specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder