Exploring iOS Metadata Manipulation in Digital Forensics

Using data extracted from an Apple iPhone, this research sought to identify the metadata available for various types of media before and after that metadata was manipulated by a user. Specifically, this research focused primarily on the metadata associated with pictures and videos taken with the camera application. I also considered another set of pictures that were taken on the Snapchat application and then downloaded to the camera roll. Of particular interest was identifying any evidence of metadata manipulation and specifics of that manipulation. When viewing pictures and videos with forensics software, location, date, and time metadata were found to be consistent with the original metadata displayed in the phone before any manipulation. After metadata manipulation, the original location, time, and date metadata were still found to be consistent with the original data, however, evidence of metadata manipulation was found in media information for the files along with the file system of the iOS device. These results indicate that a large amount of important evidence related to media is available on mobile devices. Regardless of any metadata manipulation by the user of the device, the original date, time, and location of media can be identified. Furthermore, digital evidence can indicate iOS metadata manipulation, providing additional information regarding a user’s actions on a device.