IOS Photos Media And Location Metadata
IOSPHOTOS, MEDIA & LOCATION · A GUIDE FOR UK LAWYERS iOS Photos, Media and Location Metadata What a Photograph Records Beyond the Picture, and How to Read It Honestly COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the picture is only the surface 03 What a photo's metadata records 04 The Photos library: the record of every asset 05 Reading location and dates honestly 06 Edited, deleted and altered media 07 Deployment: placing people, objects and times 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary often exactly where it was taken, and the Photos library tracks every asset, edit and album, making photos powerful for placing people and objects in time and place, provided the metadata and location are read honestly.
§ 02 · FIRST PRINCIPLES The problem in plain English: the picture is only the surface
§ 03 · PHOTOMETADATA What a photo's metadata records WHEN DEVICE WHERE EXIF + APPLE ORIGINAL ASSET
§ 04 · THEPHOTOSLIBRARY The Photos library: the record of every asset
§ 05 · LOCATIONANDDATES Reading location and dates honestly
§ 06 · EDITED, DELETEDANDALTERED Edited, deleted and altered media
§ 07 · DEPLOYMENT Deployment: placing people, objects and times
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE MAC / LOCATION COPIES / PHONE I CLOUD BACKUP S / (ORIGINAL) PHOTOS SNAPSHOTS PAIRED OTHER SHARED IPAD SOURCES PLATFORMS
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEGEOTAGTHATCONTRADICTEDTHEALIBI EXAMPLE2 · THEEDITEDPHOTOANDTHEORIGINALBENEATHIT EXAMPLE3 · THEDELETEDPHOTOSTHERECENTLY - DELETEDAREAKEPT
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORAPHOTOANDMEDIAANA LY SIS 2. Please, on the acquired, decrypted device and preserving integrity: (1) recover the Photos library and
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The photo and media checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Can a photo really show where someone was? Why does it matter which date a photo has? The photo looks edited. Can you get the original? Someone deleted photos. Are they gone? We only have a photo someone sent us. Is that enough? Can you tell if a photo is genuine?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, IOS Photos Media And Location Metadata, Computer Forensics Lab, https://e-discovery.uk/library/ios-photos-media-and-location-metadata/pdf.