Module ios 

Read-only reader for the iOS Photos “Recently Deleted” trash state in Photos.sqlite.

iOS has no filesystem-level recycle bin; “Recently Deleted” is app-level SQLite soft-delete. In the Photos library database (/private/var/mobile/Media/PhotoData/Photos.sqlite) a trashed photo or video keeps its row in the ZASSET table (named ZGENERICASSET on iOS 8–13) with:

• ZTRASHEDSTATE = 1 — the asset is in Recently Deleted, and
• ZTRASHEDDATE — when it was trashed, in Mac Absolute Time (the Cocoa / Core Data epoch, 2001-01-01; add 978 307 200 s to get a Unix timestamp).

The asset survives a ~30-day retention window before the row is purged. Recovery of purged rows (WAL, freelist, carving) is out of scope here — it is the job of the underlying sqlite_core engine, which this module reuses for all SQLite access (no libsqlite3).

Sources: The Forensic Scooter, “Photos.sqlite Query Documentation” (https://theforensicscooter.com/2022/05/02/photos-sqlite-query-documentation-notable-artifacts/); kacos2000 Photos_sqlite.sql. This module reports the live trashed rows; trash-forensic grades them.

Structs

TrashedAsset

A single iOS Photos asset currently in “Recently Deleted”.

Enums

IosError

Errors returned while reading trashed assets from a Photos.sqlite.

Functions

parse_trashed_assets

Read every currently-trashed (ZTRASHEDSTATE = 1) asset from the bytes of a Photos.sqlite, sorted by row id.

parse_trashed_assets_with_wal

As parse_trashed_assets, but layering a Photos.sqlite-wal over the main database so the trashed/restored state committed only in the WAL is seen.