Add note about Z_26ASSETS potentially being dynamically named

Neil Pankey
2020-07-02 14:48:49 -07:00
parent e8379ade97
commit 6edcbe8a78

@@ -11,10 +11,13 @@ The primary tables of concern are:
|ZPERSON|Names of persons detected in photos|
|ZDETECTEDFACE|Faces detected in photos|
|ZGENERICALBUM|Information about albums|
|Z_26ASSETS|Needed to join albums to photos|
|Z_26ASSETS|Needed to join albums to photos <sup>[1](#assets-join-table)</sup>|
|ZKEYWORD|Information about keywords|
|ZASSETDESCRIPTION|The photo description (e.g. text typed into Photos by the user)|
|ZUNMANAGEDADJUSTMENT|Information about edited photos|
|ZINTERNALRESOURCE|Appears to be information on every internal resource used by Photos; used by osxphotos to find which photos are available locally or in iCloud|
|ZCLOUDMASTER|Information about photos in iCloud; used to determine which photos have been synched to the cloud|
|ZUNIFORMTYPEIDENTIFIER|Used to determine the UTI (file type) for photos in the library|
---
<a name="assets-join">1</a>: This may actually be a dynamically named table of the from `Z_##ASSETS` as suggested by [this post](https://www.forensicmike1.com/2019/05/02/ios-photos-sqlite-forensics/) which has it as `Z_23ASSETS`. Suspect that this may be derived from a type identifier since albums can have a "super class" and this would be a reference to the an album id.