Thumbnails

Another source of important artifacts related to photos is the ithmb files. You can find these files at /CameraRollDomain/Media/PhotoData/Thumbnails. These files contain thumbnails not only for actual photos on the device but also for deleted ones. And, of course, there is a tool for parsing such files, iThmb Converter, which can be downloaded from http://www.ithmbconverter.com/en/download/ and is shown in the following screenshot:

Examining 3304.ithmb with iThmb Converter

As these files may contain thumbnails of deleted photos, they mustn't be overlooked by forensic examiners. What's more, some of them contain quite big thumbnails, so it will be clear what was pictured.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
52.15.59.163