forked/osxphotos
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Created Logs of shared images (markdown)

Rhet Turnbull
2022-09-08 07:15:43 -07:00
parent d93989bcb7
commit 3b5fd2ab98
1 changed files with 38 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
Logs-of-shared-images.md Normal file

@@ -0,0 +1,38 @@
In response to [this](https://www.reddit.com/r/ApplePhotos/comments/x7l2m3/does_photos_on_iphones_keep_detailed_logs_of/) reddit post, I did a little digging and found the following as related to reconstructing when/who an image was shared with.
## From iPhone -> MacBook (and it's likely the same iPhone to iPhone):
There's a log in the [Apple Unified Log](https://developer.apple.com/documentation/os/logging) (there are some good tools [here](https://eclecticlight.co/?s=unified+log) for working with Unified Log) that an AirDrop event occurred but it does not appear that the actual photo name is in the log. You can view log events on your iPhone from a Mac using the Console app when the phone is in proximity to the Mac. I don't know if there are tools to view log events directly on the iPhone. You can access the raw log files in the `Logs` folder on the iPhone. When you AirDrop a photo on the iPhone the following happens:
1. The `ZSHARECOUNT` value in the `ZADDITIONALASSETATTRIBUTES` table of the `Photos.sqlite` database (located in `Media/Photo Data` on the iPhone) is incremented. You can verify this by using an app that allows you to access the filesystem of the iPhone like [iMazing](https://imazing.com/).
2. There is a log entry that shows an AirDrop connection occurred:
`default 06:06:53.826292-0700 sharingd MetricEvent 'com.apple.sharing.AirDrop.SessionInfo' : { "transfersInitiated" : 1, "startTimestamp" : 684335205429, "bid" : "com.apple.mobileslideshow", "totalPeersDiscovered" : 1, "browserID" : "7D46D930DB7A", "firstDiscoveryMs" : 0.841451, "transfersCompleted" : 0, "sid" : "EF9DA930166F", "durationMs" : 8.293702, "maxPeersDiscovered" : 1, "discoveryLevel" : 2, "legacy" : false, }`
3. There's log entries showing which device and which person sharing daemon is sharing with:
`default 06:06:55.534943-0700 sharingd Query: -[SDXPCHelperConnection CGImgForNameLabelWithString:textColor:maxNumberOfLines:isAirDrop:ignoreNameWrapping:processOppositeColor:],John Doe's MacBook Pro,(UIColor 1.0,1.0,1.0,1.0),1,1,0,,2,UICTContentSizeCategoryXXL,0,,`
and
`default 06:06:57.759937-0700 sharingd Set status for John Doe’s MacBook Pro to Sent`
and
`default 06:06:57.769475-0700 sharingd Stop AirDrop session with <SFNode {John Doe,id=XXXX-D0B8-0FDD-7AE4-XXXX,dev=MacBook Pro,t=Rapport,sib=[ <SFNode {John Doe,id=XXX,dev=MacBook Pro,t=Bonjour,sib=NULL}>, <SFNode {John Does,id=XXX,dev=MacBook Pro,t=Rapport,sib=NULL}> ]}>`
4. There's also log entry showing the BlueTooth connection to the AirDrop device. (Not shown here)
## From MacBook to iPhone
1. The `ZSHARECOUNT` in `ZADDITIONALASSETATTRIBUTES` table of `Pictures/Photos Library.photoslibrary/database/Photos.sqlite` is incremented.
2. Unlike the iPhone, there *is* a log of which photo was sent in the Universal Log:
&#8203;
default 05:45:10.945714-0700 sharingd Item in the cache.
default 05:45:12.877151-0700 sharingd No conversion needed for IMG_0041.heic
default 05:45:12.878412-0700 sharingd Start transaction to "John Doe's iPhone"
default 05:45:12.878443-0700 sharingd AirDrop client transaction begin (1)
So if you really need to reconstruct this, you could write some tools to parse the logs and give you an idea of what happened. From Mac to iPhone, you could likely reconstruct exactly which photo was sent to which person (or device). From iPhone to iPhone or iPhone to Mac, you could determine which photos were shared and who photos were shared with (and when) but not necessarily who each photo was shared with (as best as I can tell...but I'm not a cyber forensic expert). But you could narrow it down based on date stamps (e.g. a photo taken after X date could not have been shared before X date).