iPhoto Forensic on Mac OS X (10.8)

According to Wikipedia, iPhoto is a digital image manipulating software application and is installed on all Mac OS X as part of the iLife digital multimedia management applications. iPhoto can import, edit, organize and print digital photos.

The iPhoto preferences and settings named “com.apple.iPhoto.plist” is stored in ~/Library/Preferences/. Notable settings includes:

Recent iPhoto  Library folder path

Screen Shot 2013-07-26 at 11.34.14 PM


Screen Shot 2013-07-26 at 11.40.03 PM

Path of album folder

Screen Shot 2013-07-26 at 11.41.53 PM

Online account sharing: Username and Service

Screen Shot 2013-07-27 at 9.06.00 AM

Another notable Plist file is ~/Library/Preferences/iApps.plist which detailed the last opened iPhoto Library

Screen Shot 2013-07-27 at 6.57.31 PM

Default path for iPhoto library is ~/Pictures/iPhoto Library.photolibrary. It is also possible that multiple iPhoto Library may be present on the system. On a Mac, the iPhoto Library appears as a single file but it is a folder containing the photos and metadata files of the library files. To explore the contents, you can right-click on the file and select “Show Package Contents”.

Screen Shot 2013-07-27 at 9.43.51 AM

One of the way is to copy the iPhoto library file to your Mac Forensic workstation. Use “Switch” to analyse the images and metadata or information attached to the albums/images.

Screen Shot 2013-07-27 at 6.26.14 PM

Version of iPhoto can be found in a file named “info.plist” in the Library folder.

Screen Shot 2013-07-27 at 7.01.10 PM

Images imported into iPhoto are placed in 3 of the folders in the iPhoto Library:

  • Masters (imported images)
  • Previews (edited images)
  • Thumbnails (thumbnail of images)

Images are placed in the folders created with respect to YYYY\MM\DD\YYYYMMDD-hhmmss.

Screen Shot 2013-07-27 at 2.48.27 PM

Another file of interest is AlbumData.xml which contained metadata pertaining to the photo albums, such as the album name and number of images.

Screen Shot 2013-07-27 at 6.37.24 PM

Screen Shot 2013-07-27 at 6.39.32 PM



Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s