diff --git a/Photos-version-5-database.md b/Photos-version-5-database.md index d65cdb9..4441da1 100644 --- a/Photos-version-5-database.md +++ b/Photos-version-5-database.md @@ -11,10 +11,13 @@ The primary tables of concern are: |ZPERSON|Names of persons detected in photos| |ZDETECTEDFACE|Faces detected in photos| |ZGENERICALBUM|Information about albums| -|Z_26ASSETS|Needed to join albums to photos| +|Z_26ASSETS|Needed to join albums to photos [1](#assets-join-table)| |ZKEYWORD|Information about keywords| |ZASSETDESCRIPTION|The photo description (e.g. text typed into Photos by the user)| |ZUNMANAGEDADJUSTMENT|Information about edited photos| |ZINTERNALRESOURCE|Appears to be information on every internal resource used by Photos; used by osxphotos to find which photos are available locally or in iCloud| |ZCLOUDMASTER|Information about photos in iCloud; used to determine which photos have been synched to the cloud| |ZUNIFORMTYPEIDENTIFIER|Used to determine the UTI (file type) for photos in the library| + +--- +1: This may actually be a dynamically named table of the from `Z_##ASSETS` as suggested by [this post](https://www.forensicmike1.com/2019/05/02/ios-photos-sqlite-forensics/) which has it as `Z_23ASSETS`. Suspect that this may be derived from a type identifier since albums can have a "super class" and this would be a reference to the an album id. \ No newline at end of file