01Location
- /data/data/com.google.android.apps.photos/databases/gphotos*.db
- /data/data/com.google.android.apps.photos/databases/local_trash.db
- /data/data/com.google.android.apps.photos/files/trash_files/
- /data/data/com.google.android.apps.photos/databases/disk_cache*
02Questions it answers
- Which local media files did the app index, with which paths and capture times?
- Which items exist in the cloud library or in shared albums?
- Which device folders are listed in the backup_folders table?
- Which items were moved to the app's trash, and are the files still present?
03Format and versions
| Format | Private SQLite databases of the Google Photos app. ALEAPP reads local_media, remote_media, shared_media and backup_folders from gphotos*.db, and local_trash.db for trashed items. |
|---|---|
| Applies to | Schema is not published by Google and varies by app version; ALEAPP checks for optional columns (e.g. trash_timestamp, purge_timestamp, inferred_latitude) before using them. |
04Key fields
| Field | What it tells you |
|---|---|
| local_media | filename, filepath, folder_name, bucket_id, media_store_id, size, dimensions, latitude/longitude. |
| remote_media | Cloud items: remote_url, upload_status (as stored), inferred_latitude/longitude where present. |
| shared_media | Items in shared albums with remote_url and size. |
| backup_folders | Bucket ids that ALEAPP joins to local_media to name folders and paths. |
| local_trash.db | Trashed items with the original local_path; matching files sit under files/trash_files. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| utc_timestamp | Unix epoch, milliseconds | Labelled "Timestamp" by ALEAPP; its exact event meaning is not documented by Google. |
| capture_timestamp | Unix epoch, milliseconds | Labelled "Captured Timestamp" by ALEAPP. |
| timezone_offset | Milliseconds | ALEAPP divides by 3,600,000 and truncates, so +5:30 shows as 5; keep the raw value. |
| trash_timestamp / purge_timestamp | Unix epoch, milliseconds | Present in some schema versions only. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Preserve every gphotos*.db, local_trash.db and trash_files content with WAL files.
- Record which optional columns exist before extracting values.
- Match local_media.filepath to files in the extraction and compare with MediaStore and EXIF data.
- Keep local, remote and shared rows separate in the timeline.
07Interpretation pitfalls
- remote_media reflects the cloud library index; it does not prove the file is on the device.
- upload_status and inferred coordinates are reported as stored; their semantics are not vendor-documented.
- Nothing in local_trash.db guarantees that a purged file can be recovered.
09Sources
- ALEAPP — scripts/artifacts/googlePhotos.py Alexis Brignoni et al. (GitHub) · checked 2026-10-14
- SQLite — Write-Ahead Logging SQLite · checked 2026-10-14