According to Wikipedia, iPhoto is a digital image manipulating software application and is installed on all Mac OS X as part of the iLife digital multimedia management applications. iPhoto can import, edit, organize and print digital photos.
The iPhoto preferences and settings named “com.apple.iPhoto.plist” is stored in ~/Library/Preferences/. Notable settings includes:
Recent iPhoto Library folder path
Path of album folder
Online account sharing: Username and Service
Another notable Plist file is ~/Library/Preferences/iApps.plist which detailed the last opened iPhoto Library
Default path for iPhoto library is ~/Pictures/iPhoto Library.photolibrary. It is also possible that multiple iPhoto Library may be present on the system. On a Mac, the iPhoto Library appears as a single file but it is a folder containing the photos and metadata files of the library files. To explore the contents, you can right-click on the file and select “Show Package Contents”.
One of the way is to copy the iPhoto library file to your Mac Forensic workstation. Use “Switch” to analyse the images and metadata or information attached to the albums/images.
Version of iPhoto can be found in a file named “info.plist” in the Library folder.
Images imported into iPhoto are placed in 3 of the folders in the iPhoto Library:
- Masters (imported images)
- Previews (edited images)
- Thumbnails (thumbnail of images)
Images are placed in the folders created with respect to YYYY\MM\DD\YYYYMMDD-hhmmss.
Another file of interest is AlbumData.xml which contained metadata pertaining to the photo albums, such as the album name and number of images.