Photos.sqlite -- IOS 8+ - Camera Roll\Media\PhotoData\Photos.sqlite -- Referencess: -- -- https://github.com/geiszla/iOSLib/wiki/ZGENERICASSET-contents -- https://github.com/geiszla/iOSLib/wiki/ZADDITIONALASSETATTRIBUTES-contents -- https://forensenellanebbia.blogspot.com/2015/10/apple-ios-recently-deleted-images.html -- SIDECAR https://en.wikipedia.org/wiki/Sidecar_file -- -- Live Photo is a video-picture hybrid file with both animated MOV and static JPG combined. -- https://appletoolbox.com/live-photos-on-iphone-complete-guide/ -- -- OriginalFilename is the filename used when this was shared in another app -- Filename is the IOS converted filename after the above image was saved on the device(iPhone) -- -- Z_PK = Primary Key (unique identifier) for the entity, -- Z_ENT = is the entity ID (every entity of a particular type has the same entity ID) -- Z_OPT = number of times an entity has been changed -- -- https://linuxsleuthing.blogspot.com/2013/05/ios6-photo-streams-recover-deleted.html -- https://discussions.apple.com/thread/8184861 select zgenericasset.Z_PK as 'zpk', case zgenericasset.ZSAVEDASSETTYPE when 0 then 'Saved from other source' when 2 then 'Photo Streams Data' when 3 then 'Made/saved with this device' when 4 then 'Default row' when 7 then 'Deleted' else zgenericasset.ZSAVEDASSETTYPE end as 'AssetType', zgenericasset.ZDIRECTORY as 'Directory', zgenericasset.ZFILENAME as 'FileName', ZADDITIONALASSETATTRIBUTES.ZORIGINALFILENAME as 'OriginalFilename', ZADDITIONALASSETATTRIBUTES.ZORIGINALFILESIZE as 'OriginalSize', -- zgenericasset.ZORIGINALCOLORSPACE as 'ColorSpace', zgenericasset.ZUNIFORMTYPEIDENTIFIER as 'FormType', ZSIDECARFILE.ZFILENAME as ' SidecarFilename', ZSIDECARFILE.ZORIGINALFILENAME as 'SidecarOriginalF', ZSIDECARFILE.ZCOMPRESSEDSIZE as ' CompressedSize', ZSIDECARFILE.ZUNIFORMTYPEIDENTIFIER as 'SidecarFormType', ZIMAGEURLDATA as 'ImageURLdata', ZTHUMBNAILURLDATA as 'ThumbnailURLdata', -- case zgenericasset.ZLATITUDE -- when -180.0 -- then '' -- else zgenericasset.ZLATITUDE -- end as ' Latitude', -- case zgenericasset.ZLONGITUDE -- when -180.0 -- then '' -- else zgenericasset.ZLONGITUDE -- end as ' Longitude', case ZCLOUDDOWNLOADREQUESTS when 0 then 'No' when 1 then 'Yes' end as 'CLOUDDOWNLOADREQUESTS', case ZCLOUDISDELETABLE when 1 then 'Yes' end as 'CLOUDISDELETABLE', case ZCLOUDISMYASSET when 1 then 'Yes' end as 'CLOUDISMYASSET', case ZCLOUDLOCALSTATE when 0 then 'Local' when 1 then 'Remote' end as 'CLOUDLOCALSTATE', case ZFAVORITE when 0 then 'No' when 1 then 'Yes' end as 'Favorite', case ZHASADJUSTMENTS when 0 then 'No' when 1 then 'Yes' end as 'Modified', ZWIDTH||' x '||ZHEIGHT as 'Dimenasions', ZADDITIONALASSETATTRIBUTES.ZEMBEDDEDTHUMBNAILWIDTH||' x '||ZADDITIONALASSETATTRIBUTES.ZEMBEDDEDTHUMBNAILHEIGHT as 'EmbeddedThumbnail', ZADDITIONALASSETATTRIBUTES.ZEMBEDDEDTHUMBNAILOFFSET as 'EmbeddedThumbnailOffset', ZADDITIONALASSETATTRIBUTES.ZEMBEDDEDTHUMBNAILLENGTH as 'ETNLength', time(ZDURATION,'unixepoch') as 'Duration', time(zgenericasset.ZVIDEOCPDURATIONVALUE, 'unixepoch') as 'CPDuration', case ZORIENTATION when 1 then 'Horizontal (left)' when 3 then 'Horizontal (right)' when 6 then 'Vertical (up)' when 8 then 'Vertical (down)' else ZORIENTATION end as 'Orientation', case ZKIND when 0 then 'Photo' when 1 then 'Video' end as 'Kind', case ZKINDSUBTYPE when 0 then 'Normal' when 1 then 'Panorama' when 100 then 'Default row' when 101 then 'Slo-mo' when 102 then 'Timelapse' else ZKINDSUBTYPE end as 'SubType', case zgenericasset.ZTRASHEDSTATE when 1 then 'Deleted' when 0 then 'Not Deleted' else zgenericasset.ZTRASHEDSTATE end as 'TrashState', datetime('2001-01-01', ZTRASHEDDATE || ' seconds') as 'TrashedDate', case ZCOMPLETE when 1 then 'Yes' end as 'Complete', case ZVISIBILITYSTATE when 0 then 'Visible' when 1 then 'Photo Streams Data' when 2 then 'Burst' else ZVISIBILITYSTATE end as 'VisibilityState', ZADDITIONALASSETATTRIBUTES.ZCREATORBUNDLEID as 'CreatorBundleID', ZADDITIONALASSETATTRIBUTES.ZEDITORBUNDLEID as 'EditorBundleID', ZUNMANAGEDADJUSTMENT.ZADJUSTMENTFORMATIDENTIFIER||' ('||ZUNMANAGEDADJUSTMENT.ZADJUSTMENTFORMATVERSION||')' as 'AdjustmentFormatIdentifier', ZSIDECARFILE.ZCAPTUREDATE as 'SidecarCaptudeDate', ZSIDECARFILE.ZMODIFICATIONDATE as 'SidecarModificationDate', ZUNMANAGEDADJUSTMENT.ZADJUSTMENTTIMESTAMP as 'AdjustmentTimestamp', -- datetime('2001-01-01', zgenericasset.ZFACEADJUSTMENTVERSION as 'FaceAdjustmentVersion', ZGENERICASSET.ZMODIFICATIONDATE as 'ModificationDate', ZADDEDDATE as 'AddedDate', ZDATECREATED as 'CreatedDate', ZADDITIONALASSETATTRIBUTES.ZEXIFTIMESTAMPSTRING as 'EXIFtimestamp', ZMOMENT.ZSTARTDATE as 'MomentStartDate', ZMOMENT.ZENDDATE as 'MomentEndDate', zgenericasset.ZLASTSHAREDDATE as 'LastSharedDate', ZADDITIONALASSETATTRIBUTES.ZTIMEZONENAME||' ('||ZADDITIONALASSETATTRIBUTES.ZTIMEZONEOFFSET||')' as 'TimeZone', ZMOMENT.ZAPPROXIMATELOCATIONDATA as 'ApproximateLocationData(bplist)', ZMOMENT.ZREVERSELOCATIONDATA as 'ReverseLocationData0(bplist)', case ZMOMENT.ZREVERSELOCATIONDATAISVALID when 0 then 'No' when 1 then 'Yes' end as 'LocationValid', ZMOMENTLIST.ZREVERSELOCATIONDATA as 'ReverseLocationData1(bplist)', case ZMOMENTLIST.ZREVERSELOCATIONDATAISVALID when 0 then 'No' when 1 then 'Yes' end as 'LocationValid1', -- case ZADDITIONALASSETATTRIBUTES.ZSHIFTEDLOCATIONISVALID -- Field does not exist in IOS 8.3 -- when 0 then 'No' -- when 1 then 'Yes' -- end as 'ShiftedLocationValid,' ZADDITIONALASSETATTRIBUTES.ZREVERSELOCATIONDATA as 'ReverseLocationData2' from zgenericasset join Z_PRIMARYKEY on zgenericasset.z_ent = Z_PRIMARYKEY.z_ent left join ZMOMENTLIST on zgenericasset.ZMOMENT = ZMOMENTLIST.Z_PK left join ZMOMENT on ZGENERICASSET."ZMOMENT" = ZMOMENT.Z_PK join ZADDITIONALASSETATTRIBUTES on ZGENERICASSET.ZADDITIONALATTRIBUTES = ZADDITIONALASSETATTRIBUTES.Z_PK left join ZUNMANAGEDADJUSTMENT on ZADDITIONALASSETATTRIBUTES."ZUNMANAGEDADJUSTMENT" = ZUNMANAGEDADJUSTMENT.Z_PK left join ZSIDECARFILE on ZSIDECARFILE.ZASSET = ZGENERICASSET.Z_PK -- order by CreatedDate desc iPhotoLite.db --IOS 9 (iphoto) --\Camera Roll\Media\PhotoData\iPhotoSandboxLibrary\438665323315681\Database\iPhotoLite.db select BLDBAlbum.uuid as 'AlbumUUID', -- Foldername BLDBAlbumMediaJoin.type, -- value can also be seen in the Album.plist in the above folders BLDBAlbum.name||' ('||BLDBAlbum.itemCount||')' as 'AlbumNamecount', case BLDBAlbum.state when 1 then 'Exists' end as 'AlbumState', case bldbmedia.state when 0 then 'Deleted' end as 'MediaState', bldbmedia.uuid 'MediaUUID', bldbmedia.fileName, bldbmedia.fileSize, bldbmedia.type as 'imageType', time(bldbmedia.duration,'unixepoch') as 'Duration', bldbmedia.latitude, bldbmedia.longitude, bldbmedia.DateCreated as 'DateCreated', case when bldbmedia.dateViewed != 0.0 then bldbmedia.dateViewed end as 'DateViewed', case when bldbmedia.dateAdjusted then bldbmedia.dateAdjusted end as 'DateAdjusted', case when bldbmedia.dateModified then bldbmedia.dateModified end as 'DateModified', bldbmedia.PixelWidth||' x '||bldbmedia.PixelHeight as 'Dimensions', bldbmedia.assetPixelWidth||' x '||bldbmedia.assetPixelHeight as 'assetDimensions', bldbmedia.originalPixelWidth||' x '||bldbmedia.originalPixelHeight as 'originalDimensions', case bldbmedia.assetOrientation when 1 then 'Horizontal (left)' when 3 then 'Horizontal (right)' when 6 then 'Vertical (up)' when 8 then 'Vertical (down)' else bldbmedia.assetOrientation end as 'AssetOrientation', case bldbmedia.originalOrientation when 1 then 'Horizontal (left)' when 3 then 'Horizontal (right)' when 6 then 'Vertical (up)' when 8 then 'Vertical (down)' else bldbmedia.originalOrientation end as 'OriginalOrientation' from bldbmedia join BLDBAlbumMediaJoin on BLDBMedia.primaryKey = BLDBAlbumMediaJoin.mediaKey join BLDBAlbum on BLDBAlbumMediaJoin.albumKey = BLDBAlbum.primaryKey -- order by DateCreated desc