When completing the data collection procedure, it is crucial to search for potential hidden images.

To do this, go under the Images section of “Analyzed Data” and switch to “Folder View.” From here, sort for “100Apple” as this will lead you to many of the user-created photos. Under “Source Information” it is not initially clear if the photos are hidden or not.

In order to check, take the source file name and search for that photo of interest in the photos.sqlite tab. The goal is to find if it is marked with the hidden flag.

From here, it is possible to make a query to see all the images and sort by whether or not they are hidden. By comparing the date/time stamps to the parsed data, you can detect the hidden photos and prove that the user had them in a hidden directory.

Share this post