Parsing iOS Camera Roll using Python
I was asked how some images of interest came to be on an iOS camera roll which started me off doing some research into the camera roll. I came across this great blog by forensicmike1 which contained lots of useful info. There is so much information in the Photos.sqlite database! The database can be found here: \private\var\mobile\Media\PhotoData\ Photos.sqlite I decided to try to write a parser to extract some of my fields of interest from Photos.sqlite. I'm a beginner with Python and SQL so I thought this would be a good lock-down project as it would undoubtedly take me ages... For this project I used iOS 13 test data from The Binary Hick My python script is available here . The info I decided I wanted to extract for each item on the camera roll was: Z_PK ZDIRECTORY ZFILENAME ZORIGINALFILENAME ZDURATION ZFAVORITE ZCREATORBUNDLEID (very useful for my original question!) ZEDITORBUNDLEID ZADDEDDATE ZDATECREATED ZMODIFICATIONDATE ZEXIFTIMESTAMPSTRING ZTRASHEDSTATE ZTRASHEDDATE ZTIMEZ