Circle of Confusion: Where was that Picture?

iOS Photos Location Adjustment Artifacts

I was enjoying an evening with fellow forensicators and, as usually happens, we began discussing features we had discovered.  While this is far from a new feature in iOS, the topic of being able to change the location information of photos arose. After sending several images back and forth, some with changed location information and some without, we found that the altered information is shown on the receiving device.

This raised the question: Is there a way to determine the original location information from these received images or, at least, something to indicate that the image had been adjusted?

Ian Whiffin conducted some excellent research on this topic previously when iOS 15 first released this feature.

When I was doing testing his observations on image adjustments in iOS 15 appear to be consistent in iOS 17. The photos.sqlite database on the originating device holds the “new” location data and the EXIF data on the original image is not changed.

You can check out Ian’s post here: https://www.doubleblak.com/blogPost.php?k=PhotoAdjustments

So, of course, research is next on the agenda.

My test devices for this experiment included an iPhone XR with iOS 17.0 and an iPhone 14 iOS 17.6.1.  The iPhone XR did not have a SIM card during this testing and was WiFi only.

The focus for this experiment was the images received by devices after their locations had been adjusted. This testing was limited to iMessage transmission.

To see if any of the same indicators exist on the received image, the image will need to be taken, changed, and sent.  At various stages, the data on the receiving phone will need to be inspected.

As I will be primarily concerned with the received images in this round of testing, images were taken with the iPhone 14 and sent via iMessage to the iPhone XR, which was then subjected to various extractions.

I began with the photos from that initial night. These images were sent to the iPhone XR via iMessage from the iPhone 14.  These images included altered and unaltered location data, and were intended simply as an initial proof of concept.  An extraction was then performed on the iPhone XR with a handy GrayKey.  As expected, the received pictures had EXIF information consistent with the information which been changed on the sending device.  As Ian observed in his research, the EXIF data had been changed when the image was sent to another device.

The first image was unchanged and the second had it’s GPS location changed to Orlando.  As expected, the EXIF data was added to the images when sent to the iPhone XR.

I also took several images with the iPhone XR.  Two live images and two still photos.  The location for one of each of these pairs was adjusted and then all four were sent to the iPhone 14 via iMessage.  Ideally, this would allow me to view one original and one adjusted image side by side on a sending device.  Once again, an extraction was performed.

The EXIF data on the images reflected the location information where the image was originally taken.  There did not appear to be a difference between Live HEIC and still HEIC images located in the \DCIM\ folder. 

Photos.sqlite also appeared to support the previous findings with the adjusted location being placed in the ZASSET and ZADDITIONALASSETATTRIBUTE tables.

So now, I have a baseline and have confirmed what we already knew about the sending/adjusting device.  The question that remains is: Is there evidence of the adjustment on the receiving device? 

While staring deeply into the images EXIF data, I noticed something peculiar:  The GPS EXIF information was different between the unaltered and altered images.  Not only were the GPS coordinates different, but the times were strange, and there was less GPS information in the altered images.

Using ExifTool (v13.33) I saw a field: GPS Date/Time.  The GPS timestamps on the unchanged photos seemed to match with the time the image was taken; and the GPS timestamps for the altered images did not.  Could this be the clue?

The images so for had been taken without a significant amount of documentation as to the times at which they were altered.  This is no way to prove a theory, so of course I needed to do some additional work.

I took this masterpiece from the comfort of my hotel:

The image was taken 7/28/2025 at 2228(CDT)/0328(UTC) 7/29/2025 in Birmingham, AL with the iPhone 14.

The next morning 7/29/2025 at 0839(CDT)/1339(UTC) I changed the location in photo to Seattle, WA. 

Later that day 7/29/2025 at 1706(CDT)/2206(UTC) I sent that image to the iPhone XR and extracted it with ArtEx.

Now that is something interesting!  The GPS EXIF information shows a timestamp at the same time as the location was changed.

Experiment number two:

Of course, we have to try it again to confirm.  I took another image at 7/29/2025 at 1910(CDT) / 7/30/2025 0010 (UTC) and then altering the location information at 7/30/2025 1250(CDT) / 1750(UTC) the next day.  The image was then sent to the XR at 2243(CDT)/0343(UTC) that evening and then the phone was extracted.

Once again, we see that the GPS Date/Time are set to the time that the location was adjusted; and not that of the image capture time or sent time.  The original device must be storing the adjustment time somewhere and stamping it on the sent image with EXIF data.

We can also see that the GPS data in the adjusted images are missing a number of fields; which are present in the images that were not adjusted.

In conclusion, images which have had their location altered and then received by a device have the altered EXIF data within the file.  That EXIF data has some significant differences due to the alteration.  Not only are several fields missing or changed but the GPS timestamp is that of the time the location was adjusted.

This is obviously just scratching the surface.  The originating device must hold this adjustment date and time somewhere before stamping it into the EXIF data.  Images sent from non-Apple devices may result in in different data as well.  An in-depth analysis of logs may be needed to understand the mechanism behind these changes.