Digital Forensics of HEIC files from iOS

by | Mar 30, 2018 | Forensic Impact | 0 comments

Guest Blogger: Chief Todd A. Faulkner, Hinsdale Police Department

High-Efficiency Image Compression (HEIC) is the new format that applies only to Apple devices that have the A9 processor or more modern. This includes iPhone 6S, 6S Plus, iPad Pro and 2017 iPad 9.7”.

Before we discuss how to deal with this format as it pertains to the forensic world, we must first understand HEIC files. HEIC are HEIF files (High-Efficiency Image Format) which is the still image version of HEVC (High-Efficiency Video Compression) files. HEIC files are not technically file formats and Apple uses them more like a storage container for still images within the HEVC format.

Now, Apple cannot take credit for designing the HEIC format, as it was actually designed by the MPEG group. This is the same group that designed the Advanced Audio Coding (AAC) file format for iTunes. HEIC is a very versatile format with many benefits such as;

  • File size about half of a JPG file for the same image quality
  • Multiple photos can be stored in one file (Live Photo and Bursts)
  • Supports transparency like GIFs
  • Image editing can be undone (cropping, rotation, etc.)

HEIC has been in the works for several years. It was reported last year as the up-and-coming format for images due to its ability to save the same quality images at half that of JPEG, and it has been suggested that they are future replacement of JPEG. An interesting piece of information is that Google is reported to be working on a different compression format that will shrink file size an additional 15% below that of HEIC.

Currently, there are no programs, plugins or applications that recognize HEIC files that are standard on Windows or Mac machines. In fact, Apple’s own photo viewer doesn’t recognize them. For a Mac to be able to support HEVC files it will need a 6th generation Intel processor or newer. This would include the late 2015 iMAC 27” or 2017 21.5”, MacBook 2016 or newer, or MacBook Pro late 2016 or newer. A side note is that with the release of OS High Sierra, HEIC support is added, to a point. Again, depending on the model of your computer (Mac), you may be able to read HEIC files, but you will not be able to export them. HEVC files can be played using QuickTime Player.

There are a few options that we have to view the files, however; it is not impossible.

  1. If you don’t suspect that there are CSAI/V images that you can upload a working copy of the image to Dropbox and view them with the built-in player. We don’t want to do this if we’re working a  CP or contraband case.
  2. Upload a working copy to Google Drive and the file will automatically be converted to a .jpeg file format. These can then be viewed normally. Again, a bad call for CP cases. Google Photos also supports this.
  3. Use a HEIC/F to JPG file converter. I would use a working copy, however; this is usually on online type activity, and with CP cases I wouldn’t do it.
  4. Microsoft OneDrive does the same as the others
  5. Use a HEIC viewer on an android tablet or phone. The source code is out and the play store does have a viewer.
  6. Lastly, you can manually set the phone to transfer image files to your PC and automatically convert them to a compatible format.

HEIC

HEIC

I would highly recommend that we go a little old school on this and when you export your files, create a clean and working copy folder. These folders can then have exact copies of the HEIC files you place into them. You should then hash each file pre-and post-work.

Conversion by a 3rd party tool will likely cause a hash change since you are changing the file extension and changing the file size; however, viewing them in native format within One Drive, Google Photos, or Dropbox should not. If you share the file from your iPhone or iPad via e-mail, it will convert it to a JPEG file.

Also, testing still needs to be done on what data is stripped by these third-party tools. Your tool should be able to gather the necessary data regarding file use and knowledge. If this information is removed by your attempt to process the file for viewing, then you should still be able to reference the original for accurate metadata of the image.

Remember, this is only for images captured by the device. All other support of iOS11 is still in full play so don’t give up as this is a tiny segment of what we may not be able to get.

To aid in this processing, Paraben is adding a sort category of just these images so they can be exported easily for viewing.