01Location
- /private/var/mobile/Media/PhotoData/Photos.sqlite (+ -wal, -shm)
02Questions it answers
- When was a photo created and when was it added to the library?
- Is the asset in Recently Deleted, and since when?
- Is the asset local, from iCloud Photos or from a shared album?
- Which location and original file name are recorded?
03Format and versions
| Format | Core Data SQLite store. Assets are in ZGENERICASSET (iLEAPP's iOS 12–13 queries) or ZASSET (iOS 14+ queries), with ZADDITIONALASSETATTRIBUTES, ZDETECTEDFACE and ZPERSON for extra attributes, faces and people. |
|---|---|
| Applies to | Schema changes across iOS versions; Koenig's queries were tested on iOS 12–16. Face links use ZASSET/ZPERSON or ZASSETFORFACE/ZPERSONFORFACE depending on release. |
04Key fields
| Field | What it tells you |
|---|---|
| ZDIRECTORY / ZFILENAME / ZORIGINALFILENAME | Storage folder, current file name and original name. |
| ZTRASHEDSTATE | 1 = marked as trash and listed in Recently Deleted. |
| ZSAVEDASSETTYPE | Koenig: 3 local library, 4 cloud sharing data, 6 iCloud Photo Library asset, 8 cloud master moment asset. |
| ZLATITUDE / ZLONGITUDE | Stored coordinates of the asset. |
| ZEXIFTIMESTAMPSTRING / ZTIMEZONEOFFSET / ZTIMEZONENAME | EXIF time string and time-zone data from additional attributes. |
| ZCLOUDASSETGUID | Cloud identifier of the asset. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| ZDATECREATED | Apple Cocoa time (seconds since 2001-01-01 UTC) | Created date (UTC) of the asset. |
| ZADDEDDATE | Apple Cocoa time | When the asset was added to the library. |
| ZMODIFICATIONDATE | Apple Cocoa time | Record modification time. |
| ZTRASHEDDATE | Apple Cocoa time | When the asset was moved to trash. |
| ZLASTSHAREDDATE | Apple Cocoa time | A shared date does not prove the asset was actually shared. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Identify the iOS version and whether the asset table is ZGENERICASSET or ZASSET.
- Join additional attributes and, if needed, faces, keeping one row per asset for counts.
- Convert all Cocoa dates and compare created, added and EXIF times.
- Match ZDIRECTORY/ZFILENAME to files on disk; note missing files.
- Review trashed assets against the 30-day Recently Deleted window.
07Interpretation pitfalls
- Items in Recently Deleted stay there for 30 days; after that rows and files may be gone.
- Joining faces or albums multiplies rows per asset.
- Cloud assets (iCloud Photos, shared albums) may not originate from this device.
09Sources
- iLEAPP — scripts/artifacts/photosMetadata.py Alexis Brignoni et al. (GitHub) · checked 2026-10-14
- Local Photo Library Photos.sqlite Query Variations & WHERE statements Scott Koenig, The Forensic Scooter (2022) · checked 2026-10-14
- How to recover deleted photos on your iPhone, iPad, Mac, or Apple Vision Pro Apple Support · checked 2026-10-14
- CFAbsoluteTime Apple Developer Documentation · checked 2026-10-14