This week’s Tip Tuesdays relates to when you need to search, sort or filter by hidden photos.

People typically hide photos because they don’t want anyone to know that they have them on the device. Here’s how to search for hidden photos.

At the top of the page in UFED Cloud, if you search for Hidden By User that’s the easiest way to filter and sort these photos and provide them in your forensic report.

You see I have three extractions, with 23 in my iTunes backup, three in this other iTunes backup, and nothing in this mini extraction.

The first Hidden By User tab shows extracted data on the right-hand side and we can see we also have information on them.

If you open the actual image file and switch to file info view, that is where you actually see that it’s hidden by the user.

You can go back and look through all the photos the user chose to hide.

If I look at my own file, you can see it also includes items that are in the cloud with cloud photo library assets which include hidden videos, hidden screenshots, and whatever the user is hiding on the gallery view of their device that can sync to the cloud, be on the device and exist anywhere.

Watch the full episode to learn more.

Share this post