Queries/Photos_sqlite.sql

-- IOS Camera Roll\Media\PhotoData\Photos.sqlite

-- References:
--
-- https://github.com/geiszla/iOSLib/wiki/ZGENERICASSET-contents
-- https://github.com/geiszla/iOSLib/wiki/ZADDITIONALASSETATTRIBUTES-contents
-- https://forensenellanebbia.blogspot.com/2015/10/apple-ios-recently-deleted-images.html
-- SIDECAR https://en.wikipedia.org/wiki/Sidecar_file
--
-- Live Photo is a video-picture hybrid file with both animated MOV and static JPG combined. 
-- https://appletoolbox.com/live-photos-on-iphone-complete-guide/ 
-- 
-- OriginalFilename is the filename used when this was shared in another app
-- Filename is the IOS converted filename after the above image was saved on the device(iPhone)
--
-- Z_PK = Primary Key (unique identifier) for the entity,
-- Z_ENT = is the entity ID (every entity of a particular type has the same entity ID)
-- Z_OPT = number of times an entity has been changed
--
-- https://linuxsleuthing.blogspot.com/2013/05/ios6-photo-streams-recover-deleted.html
-- https://discussions.apple.com/thread/8184861 

select 
	Z_PRIMARYKEY.Z_NAME as 'Type',
	case zgenericasset.ZSAVEDASSETTYPE
			when 0 then 'Saved from other source'
			when 2 then 'Photo Streams Data'
			when 3 then 'Made/saved with this device'
			when 4 then 'Default row'
			when 7 then 'Deleted'
			else zgenericasset.ZSAVEDASSETTYPE
			end as 'AssetType',
	ZDIRECTORY as 'Directory',
	ZFILENAME as 'FileName',
	ZADDITIONALASSETATTRIBUTES.ZORIGINALFILENAME as 'OriginalFilename',
	ZADDITIONALASSETATTRIBUTES.ZORIGINALFILESIZE as 'OriginalSize',
	ZUNIFORMTYPEIDENTIFIER as 'FormTypeIdentifier',
	ZIMAGEURLDATA as 'ImageURLdata',
	ZTHUMBNAILURLDATA as 'ThumbnailURLdata',
	case ZCLOUDDOWNLOADREQUESTS
		when 0 then 'No'
		when 1 then 'Yes'
		end as 'CLOUDDOWNLOADREQUESTS',
	case ZCLOUDISDELETABLE 
			when 1 then 'Yes'
			end as 'CLOUDISDELETABLE',
	case ZCLOUDISMYASSET  
			when 1 then 'Yes'
			end as 'CLOUDISMYASSET',
	case ZCLOUDLOCALSTATE 
		when 0 then 'Local'
		when 1 then 'Remote'
		end as 'CLOUDLOCALSTATE',		
	case ZFAVORITE   
			when 0 then 'No'
			when 1 then 'Yes'
			end as 'Favorite',		
	case ZHASADJUSTMENTS    
			when 0 then 'No'
			when 1 then 'Yes'
			end as 'Modified',
	ZWIDTH||' x '||ZHEIGHT as 'Dimenasions(WxH)',
	ZADDITIONALASSETATTRIBUTES.ZEMBEDDEDTHUMBNAILWIDTH||' x '||ZADDITIONALASSETATTRIBUTES.ZEMBEDDEDTHUMBNAILHEIGHT as 'EmbeddedThumbnail(WxH)',
	ZADDITIONALASSETATTRIBUTES.ZEMBEDDEDTHUMBNAILOFFSET as 'EmbeddedThumbnailOffset',
	ZADDITIONALASSETATTRIBUTES.ZEMBEDDEDTHUMBNAILLENGTH as 'ETNLength',
	time(ZDURATION,'unixepoch') as 'Duration',
	case ZORIENTATION    
			when 1 then 'Horizontal (left)'
			when 3 then 'Horizontal (right)'
			when 6 then 'Vertical (up)'
			when 8 then 'Vertical (down)'
			else ZORIENTATION
			end as 'Orientation',
	case ZKIND    
			when 0 then 'Photo'
			when 1 then 'Video'
			end as 'Kind',
	case ZKINDSUBTYPE    
			when 0 then 'Normal'
			when 1 then 'Panorama'
			when 100 then 'Default row'
			when 101 then 'Slo-mo'
			when 102 then 'Timelapse'
			else ZKINDSUBTYPE
			end as 'SubType',
	case zgenericasset.ZHIGHDYNAMICRANGETYPE 
		when 0 then 'No HDR'
		when 1 then 'Low'
		when 6 then 'High'
		else zgenericasset.ZHIGHDYNAMICRANGETYPE
		end as 'HDRtype', --Seen values 0, 1 and 6
	case zgenericasset.ZTRASHEDSTATE     
			when 1 then 'Deleted'
			when 0 then 'Not Deleted'
			else zgenericasset.ZTRASHEDSTATE
			end as 'TrashState',
	datetime('2001-01-01', ZTRASHEDDATE || ' seconds') as 'TrashedDate',
	case ZCOMPLETE  
			when 1 then 'Yes'
			end as 'Complete',		
	case ZVISIBILITYSTATE     
			when 0 then 'Visible'
			when 1 then 'Photo Streams Data'
			when 2 then 'Burst'
			else ZVISIBILITYSTATE
			end as 'VisibilityState',
	ZADDITIONALASSETATTRIBUTES.ZCREATORBUNDLEID as 'CreatorBundleID',
	ZADDITIONALASSETATTRIBUTES.ZEDITORBUNDLEID as 'EditorBundleID',
	ZUNMANAGEDADJUSTMENT.ZADJUSTMENTFORMATIDENTIFIER||' ('||ZUNMANAGEDADJUSTMENT.ZADJUSTMENTFORMATVERSION||')' as 'AdjustmentFormatIdentifier',
	datetime('2001-01-01', ZUNMANAGEDADJUSTMENT.ZADJUSTMENTTIMESTAMP || ' seconds') as 'AdjustmentTimestamp',
	datetime('2001-01-01', zgenericasset.ZMODIFICATIONDATE || ' seconds') as 'ModificationDate',
	datetime('2001-01-01', ZADDEDDATE || ' seconds') as 'AddedDate',
	datetime('2001-01-01', ZDATECREATED || ' seconds') as 'CreatedDate',
	ZADDITIONALASSETATTRIBUTES.ZEXIFTIMESTAMPSTRING as 'EXIFtimestamp',
	datetime('2001-01-01', ZMOMENT.ZSTARTDATE || ' seconds') as 'MomentStartDate',
	datetime('2001-01-01', ZMOMENT.ZENDDATE || ' seconds') as 'MomentEndDate',
	datetime('2001-01-01', zgenericasset.ZLASTSHAREDDATE || ' seconds') as 'LastSharedDate',
	ZADDITIONALASSETATTRIBUTES.ZTIMEZONENAME||' ('||ZADDITIONALASSETATTRIBUTES.ZTIMEZONEOFFSET||')' as 'TimeZone',
	ZMOMENT.ZAPPROXIMATELOCATIONDATA as 'ApproximateLocationData(bplist)',	
	ZMOMENT.ZREVERSELOCATIONDATA as 'ReverseLocationData0(bplist)',	
	case ZMOMENT.ZREVERSELOCATIONDATAISVALID 
		when 0 then 'No'
		when 1 then 'Yes'
		end as 'LocationValid',	
	ZMOMENTLIST.ZREVERSELOCATIONDATA as 'ReverseLocationData1(bplist)',		
	case ZMOMENTLIST.ZREVERSELOCATIONDATAISVALID 
		when 0 then 'No'
		when 1 then 'Yes'
		end as 'LocationValid',
	ZADDITIONALASSETATTRIBUTES.ZREVERSELOCATIONDATA as 'ReverseLocationData2(bplist)'
	-- ,	
	-- case ZADDITIONALASSETATTRIBUTES.ZSHIFTEDLOCATIONISVALID -- Field does not exist in IOS 8.3 (remove "--" for other versions)
	--	when 0 then 'No'
	--	when 1 then 'Yes'
	--	end as 'ShiftedLocationValid'
	
from zgenericasset
	join Z_PRIMARYKEY on zgenericasset.z_ent = Z_PRIMARYKEY.z_ent
	left join ZMOMENTLIST on zgenericasset.ZMOMENT = ZMOMENTLIST.Z_PK
	left join ZMOMENT on ZGENERICASSET."ZMOMENT" = ZMOMENT.Z_PK
	join ZADDITIONALASSETATTRIBUTES on ZGENERICASSET.ZADDITIONALATTRIBUTES = ZADDITIONALASSETATTRIBUTES.Z_PK
	left join ZUNMANAGEDADJUSTMENT on ZADDITIONALASSETATTRIBUTES."ZUNMANAGEDADJUSTMENT" = ZUNMANAGEDADJUSTMENT.Z_PK
order by CreatedDate desc