I recently noticed a few questions being posted on the listservs and DFIR Discord about examiners locating assets in file system (fs) locations like /private/var/mobile/Media/PhotoData/Metadata/DCIM/100APPLE/* and then not being able to find the corresponding original full-sized asset in the /private/var/mobile/Media/DCIM/100APPLE/* fs location. Full-resolution versions can be downloaded from iCloud anytime.” “If your iPhone is low on space, full-resolution photos and videos are automatically replaced with smaller, device-sized versions. Here is what is listed in the settings menu for Optimize iPhone Storage: I’ve always had a curiosity about the forensic impact this might have on my examinations but have never had enough time to research it, yet. I’ve used this setting in the past because most devices I’ve encountered are using this setting. Hello everyone! During previous research, I’ve mentioned a few times that my test devices were using the Apple Photos application setting Optimize iPhone Storage in lieu of Download and Keep Originals setting.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |