Photos Metadata Database (Photos.sqlite)

Location

Description

SQLite database containing metadata for all photos and videos in the device photo library. Stores EXIF data including GPS coordinates, camera settings, creation and modification timestamps, face recognition data, scene classification labels, and iCloud Photos sync status. The ZASSET table contains one record per media item with extensive metadata columns.

Forensic Value

Photos.sqlite provides GPS coordinates embedded in photo EXIF data that place the device at specific locations when photos were taken, creating a photographic location timeline. Face recognition data in the ZDETECTEDFACE table identifies people appearing in photos even if the user did not manually tag them. Scene classification labels automatically assigned by iOS machine learning reveal photo content without requiring manual review of every image. Deleted photos tracked in the ZASSET table with a trashed state may be recoverable for 30 days after deletion. iCloud sync metadata reveals which photos were uploaded to the cloud and when, relevant for cloud evidence collection.

Tools Required

Collection Commands

idevicebackup2 backup --full /forensics/ios_backup/

python3 ileapp.py -t tar -i /path/to/backup -o /forensics/output/

python3 meat.py -i -o /forensics/output/ -t backup

Collection Constraints

• •Availability depends on iOS version, device lock state, backup class, and extraction method. Many protected domains require a full filesystem extraction or sysdiagnose rather than a standard backup.
• •Mobile application data may be partially cached, excluded from backup, or pruned by the OS. Validate against the extraction type before treating gaps as meaningful.

MITRE ATT&CK Techniques

References