iOS Data Analysis and Recovery - Practical Mobile Forensics - page 170

Photos
Photos are stored in a directory located at /private/var/mobile/Media/DCIM/ ,
which contains the photos taken with the device's built-in camera, screenshots, and accom-
panying thumbnails. Some third-party applications will also store photos taken in this dir-
ectory. Every photo stored in the DCIM folder contains EXIF (Exchangeable Image File
Format) data. EXIF data stored in the photo can be extracted using exiftool , which can be
downloaded from http://www.sno.phy.queensu.ca/~phil/exiftool/ . EXIF data may also con-
tain the geographical information when a photo is tagged with the user's geo location if the
user has enabled location permissions on the iOS device:
$exiftool IMG_0107.JPG
ExifTool Version Number : 9.50
File Name : IMG_0107.JPG
Directory : .
File Size : 73 kB
File Modification Date/Time : 2014:01:07 17:43:05+05:30
File Access Date/Time : 2014:02:09 17:26:40+05:30
File Inode Change Date/Time : 2014:02:09 17:26:40+05:30
File Permissions : rw-r--r--[...]