Multimedia files-- Apple has so many options,
and it can be extremely confusing.
When we look at data, you will get EXIF data
if location artifacts are turned on.
You should be able to tell the make and model of the device
that sent it, when they sent it, location artifacts--
if they exist--
when it was created, modified, last accessed-- lots
of information here.
If the user takes a photo or saves a photo from a chat,
from a browser, from anywhere, if they get an airdrop--
it goes to DCIM 100APPLE.
Now, that 100APPLE will grow in size numerically.
If you look at my device, it says 1,003--
or 103Apple, because I have so many pictures.
Pictures can be stored as JPEG, PNG, HEIC, or HEIF.
So there are many ways that you may see it stored.
But what's important is, if you find photos
that exist in this location, the user or someone like the user
wanted to save that photo.
That's very important they don't just magically appear there.
If you have recordings, they will exist in recordings.
Now, what's interesting is I have apparently
a setting on my child's iPad to sync all recordings
to my device.
When I even do an iTunes backup, as long as I encrypt it,
I get his recordings.
So any time he's talking to Siri,
I don't know what he does sometimes
when he's talking to it that he creates a recording,
but it gets sync to my device.
We're going to talk more about photo data.
So in PhotoData, you will see DCIM thumbnails.
If the user deletes a photo, it's
not always going to delete it from thumbnails.
You may also find thumbnails from other applications,
from pictures that are only in cloud.
This is something that comes up a lot in our Google Chat
group on Hi ICA DCIM thumbnail, but I can't find the associated
picture.
And I responded to the student saying,
the person may have checked that box on their iPhone saying,
optimize my device by only having this in cloud
to save space.
CPL-- any time you see that word--
cloud photo library.
The person has photos in cloud.
And then there's so much more that we're
going to take a look at.
Photo stream-- if you have photo stream enabled,
it's an exact copy, essentially, of every picture
you've taken on your device.
It eats up a lot of space, but if the person
deletes from one category, it will
take possibly a period of time before it
deletes from photo stream.
When we look at family share, or group shares, or shared photos,
if the person actively has a photo share on their device,
there's a plist file associated with it telling you
who is the owner and who all has access to that.
That could be really important in many investigations
that you're working.
Recently deleted obviously makes sense.
It is what it is.
Selfies, and then hidden--
so starting with iOS 11 through iOS 15,
you have a hidden directory on your iPhone.
All this does is keep those pictures from showing up
in your gallery.
If you even get an encrypted iTunes backup,
you get all of those pulled out.
Now, you are going to do a lab in section 4,
and I'm going to ask you, are you
able to uncover any hidden photos?
The fact that someone has a special photo in a hidden
category could make a lot of sense.
Now, it may not be anything of relevance.
If you look at mine, I have my vaccine card.
I have a picture of my passport, a picture of my driver's
license, because I'm notorious for logging myself out
of hotel rooms at SANS events with my wallet in the safe.
So I can just show my ID on my phone.
But what if that's where you put the pictures
of the drugs that you are dealing,
or the weapons that you have access to,
or people you are stalking?
People do weird things.
You want to know if something is hidden.