Photos Metadata Database (Photos.sqlite)

Location

Description

SQLite database containing metadata for all photos and videos in the device photo library. Stores EXIF data including GPS coordinates, camera settings, creation and modification timestamps, face recognition data, scene classification labels, and iCloud Photos sync status. The ZASSET table contains one record per media item with extensive metadata columns.

Forensic Value

Photos.sqlite provides GPS coordinates embedded in photo EXIF data that place the device at specific locations when photos were taken, creating a photographic location timeline. Face recognition data in the ZDETECTEDFACE table identifies people appearing in photos even if the user did not manually tag them. Scene classification labels automatically assigned by iOS machine learning reveal photo content without requiring manual review of every image. Deleted photos tracked in the ZASSET table with a trashed state may be recoverable for 30 days after deletion. iCloud sync metadata reveals which photos were uploaded to the cloud and when, relevant for cloud evidence collection.

Tools Required