Depending on your tool, the tools
will do some correlation for you on where information actually
stands.
So this picture on the left-hand side--
this is actually Oxygen Forensics.
Oxygen does a great job at this correlation.
This is only true for iPhone.
This is not true for Android.
Everyone always asks, can you do this on Android?
You cannot.
So you have a photo.
In this picture, you can see it's my daughter,
and she's standing.
And I remember I got a text message saying,
you better hurry home from work.
You're going to miss her walking.
And I was super annoyed by that.
But I saved it.
So I received this message on 2/5/2018.
I saved it to my device.
You can see last access time.
I posted it to Instagram on 2/7/2018--
easy.
When we look at this, we see EXIF digitized,
EXIF original and the EXIF make/model.
This is the device that took that photo.
That photo was taken on 2/5/2018 at 17:33.
It was not sent to me until 23:05.
So we have these different things.
Now, when you get a photo that is texted to you
or shared with you, the second you click on the arrow
to save it, something interesting occurs on iPhone.
Your coordinates on where you are in the world when you
save that photo are captured.
So here you can see this address, Creekside Drive,
Arbor Pointe Apartments, New Castle County, Delaware.
I was like, that's weird, when I looked at this.
I know where that photo was taken.
That made no sense to me.
So I click on a map, and I can actually
see the Amtrak train that is running right behind Newcastle
County, Delaware.
I was on the train when I saved that photo to my device.
Apple knows where you are when you save photos.
Think about how this could impact
some of your investigations.
It's very creepy.
Now, if you look at the metadata,
it would only show the location artifacts
for where that photo was taken.
So it's only showing the original.
The tools are smart enough to go and be,
like I know where this person was
where they saved this photo.
It's really, really creepy what Apple does in the background,
but it really helps forensically if you understand.
Don't let it confuse you.
Make sure you break down the logic.
And if you even look, how this is worded,
it says device owner's geodata.
In my mind, that meant the person that took the photo.
But it's not.
It's the person's device that you're examining.