Android Motion Photos in Magnet AXIOM
Hi! This is Jessica Hyde, Director of Forensics at Magnet Forensics. I want to take a moment to talk about Android Motion Photos. This artifact is similar to Live Photo that some folks may be familiar with on iOS. This feature is available on some Android devices but not all and can be disabled by the user. On a device that supports Motion Photo, the images will be stored as a JPEG that has an MP4 Video embedded within the .jpg file.
What is great about Motion Photos is that they can show items in a scene that are not revealed in the jpg itself. I spoke about this artifact and how it compares to Live Photos at my presentation with Chris Vance during our her Android/iOS comparative webinar. If you would like to check out some data that has motion photos in it, check out the Magnet Virtual Summit 2020 CTF images. Some may recognize this artifact from the #MagnetWeeklyCTF Week 3 challenge.
In AXIOM 4.9, we have added native support for the embedded .MP4s with Motion Photo Artifact. There are so many things I love about having the photo and video together. In the picture below, you can see the still frame of the motion photo as well as the location I have paused the video on. The video may only be one second, but if you play it slowly in the viewer, you can see that there is a sign in the video that can help you understand the perspective from where the picture was taken. This video preview not only allows you to play slowly and pause, but you can actually screenshot directly in the preview to create a picture of an important frame.
Figure 1: Motion Photo Artifact
In addition to seeing the video preview, this artifact has a tremendous amount of EXIF data including geolocation and multiple time stamps allowing us to view this artifact in both the map view and timeline view. Additionally, the EXIF data can be used to validate the make and model of the device that created the Motion Photo. Tarah Melton, Forensic Consultant, demonstrates working with this new artifact in this video.
We hope that this artifact will aid you in your Android investigations. If you have any questions or comments about Motion Photo artifact, feel free to reach out to me via email at jessica.hyde@magnetforensics.com.