Introducing EXIF metadata
The Photos.sqlite database can be a huge source of metadata, but there may be some occasions in which the database is not available, and the investigator only has access to the media file. Thankfully, images and videos often contain embedded metadata, which is known as Exchangeable Image File Format (EXIF).
EXIF metadata can provide a wealth of information to investigators, such as the following:
- The device model
- Camera settings
- Exposure and lens specifications
- Timestamps
- Location data
- Altitude and bearing
- Speed reference
When a photo or video is captured through an iOS device's built-in camera, EXIF metadata is automatically added to the media asset. The following screenshot shows the amount of metadata that can be extracted from a photo that was taken on an iPhone SE:
Figure 9.6 – EXIF metadata extracted from a photo that was captured on an iPhone
As you can see, by analyzing...
