From 6edcbe8a78375b4df1c831b9f55caa40ff24a91d Mon Sep 17 00:00:00 2001 From: Neil Pankey Date: Thu, 2 Jul 2020 14:48:49 -0700 Subject: [PATCH] Add note about Z_26ASSETS potentially being dynamically named --- Photos-version-5-database.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/Photos-version-5-database.md b/Photos-version-5-database.md index d65cdb9..4441da1 100644 --- a/Photos-version-5-database.md +++ b/Photos-version-5-database.md @@ -11,10 +11,13 @@ The primary tables of concern are: |ZPERSON|Names of persons detected in photos| |ZDETECTEDFACE|Faces detected in photos| |ZGENERICALBUM|Information about albums| -|Z_26ASSETS|Needed to join albums to photos| +|Z_26ASSETS|Needed to join albums to photos [1](#assets-join-table)| |ZKEYWORD|Information about keywords| |ZASSETDESCRIPTION|The photo description (e.g. text typed into Photos by the user)| |ZUNMANAGEDADJUSTMENT|Information about edited photos| |ZINTERNALRESOURCE|Appears to be information on every internal resource used by Photos; used by osxphotos to find which photos are available locally or in iCloud| |ZCLOUDMASTER|Information about photos in iCloud; used to determine which photos have been synched to the cloud| |ZUNIFORMTYPEIDENTIFIER|Used to determine the UTI (file type) for photos in the library| + +--- +1: This may actually be a dynamically named table of the from `Z_##ASSETS` as suggested by [this post](https://www.forensicmike1.com/2019/05/02/ios-photos-sqlite-forensics/) which has it as `Z_23ASSETS`. Suspect that this may be derived from a type identifier since albums can have a "super class" and this would be a reference to the an album id. \ No newline at end of file