The PhotoData directory contains files the user may not even realize exist on their iPhone. On the left, we see artifacts associated with Live Photos on iOS devices. Most users do not realize that a .MOV file is created for every Live Photo taken on an iOS device. This data is saved in the PhotoData directory and can be reviewed for relevance. Audio is also included for these files. Pretty amazing evidence when trying to place a person or subject behind a mobile device. The .JPG above the .MOV file is the image the user sees or saw on the device. 

The screenshot on the right shows the artifacts left behind when a user snaps a picture from within the SMS application. The location for these photos is /var/mobile/Media/PhotoData/Thumbnails/V2/DCIM/*. These photos are not stored in the user’s gallery (except in iOS 12); however, the thumbnails and pictures are captured and saved to the device. This data cannot be viewed easily by the user unless they back up their device—again, fantastic artifacts here! Use caution when searching for a file name, as you will notice that the images all have the same file name, but the path will differ. Also, take notice that HEIC image directories are saved as JPG. This means our tool can render the graphics for us. One thing that is odd is that the .JPG files all have the same name. The only thing unique is the directory containing that file, which may be a better search term.