Apple (iOS 15) "Saved from" field - EXIF?

[raleigh_littles]

In iOS 15 [2021], Apple added a way to view what application an image was saved from: https://www.macrumors.com/2021/06/14/ios-15-photos-app-shows-where-images-saved-from/

Does anyone know if this information is stored in the EXIF data? I didn't see it mentioned on the Apple Tags, https://exiftool.org/TagNames/Apple.html but I don't know if that's simply because that field hasn't been decoded yet.

[wywh]

It seems they are stored in XAttrMDItemWhereFroms (and XAttrQuarantine) tags. Use -api RequestAll=2 to see more info such as FileCreateDate.

BTW in macOS 13.4.1 (exiftool 12.60) XAttrMDItemWhereFroms does not seem to need -overwrite_original_in_place to survive and -overwrite_original is enough. Also Finder color tags at XAttrMDItemUserTags survive -overwrite_original. On the other hand, MDItemFSFinderFlags and MDItemFSLabel need -overwrite_original_in_place to survive (Finder displays all XAttrMDItemUserTags while GraphicConverter 12 Browser main list view displays MDItemFSLabel color tag which seems to be the very last of the XAttrMDItemUserTags).

Sample image downloaded via macOS 13.4.1 Safari, Finder color tags added later. Image downloaded in iOS 15.7.7 to its Photos seem to behave the same but copying the image to macOS deletes XAttrMDItemWhereFroms.

Code Select Expand

exiftool -a -G1 -s '-XAttr*' -MDItemFSFinderFlags -MDItemFSLabel safari.jpg                                   
[MacOS]         XAttrFinderInfo                 : Type='' Creator='' Flags=(none) Label=4 Pos=(0,0)
[MacOS]         XAttrMacl                       : (Binary data 72 bytes, use -b option to extract)
[MacOS]         XAttrMDItemUserTags             : Red.6, Green.2, Blue.4
[MacOS]         XAttrMDItemDownloadedDate       : 2023:07:24 11:23:06+03:00
[MacOS]         XAttrMDItemWhereFroms           : https://www.plantmegreen.com/cdn/shop/products/Macintosh_Apple_Lifestyle.jpg?v=1571438501
[MacOS]         XAttrQuarantine                 : Flags=0083 set at 2023:07:24 08:23:06 by Safari B6D39EC2-21FD-4D92-B982-BD712575CEDE
[MacOS]         MDItemFSFinderFlags             : 8
[MacOS]         MDItemFSLabel                   : 4 (Blue)

exiftool -overwrite_original -GPSLatitude=36.6101 -GPSLatitudeRef=S -GPSLongitude=66.91515 -GPSLongitudeRef=W safari.jpg
    1 image files updated

exiftool -a -G1 -s '-XAttr*' -MDItemFSFinderFlags -MDItemFSLabel safari.jpg                                             
[MacOS]         XAttrMDItemUserTags             : Red.6, Green.2, Blue.4
[MacOS]         XAttrMDItemDownloadedDate       : 2023:07:24 11:23:06+03:00
[MacOS]         XAttrMDItemWhereFroms           : https://www.plantmegreen.com/cdn/shop/products/Macintosh_Apple_Lifestyle.jpg?v=1571438501
[MacOS]         MDItemFSFinderFlags             : 0
[MacOS]         MDItemFSLabel                   : 0 (none)
- Matti

[Phil Harvey]

Thanks Matti for the comprehensive response.

- Phil

[raleigh_littles]

Thanks for the very detailed response!

However, I think you're describing something slightly different than what my question was referring to. You're describing the case where you download an image from a browser on Mac, and access the data using the MacOS Extended File Attributes, if I'm not mistaken. My question was about downloading images on iOS, from an application in general, not necessarily the browser. Here's an example of what I mean.

This source image, I downloaded from Chrome, on my iPhone: https://i.imgur.com/i49nMB9.jpg

When I go into the Gallery, I see "Saved from Chrome" on the image: https://i.imgur.com/BA6tWW4.jpg

This 'Saved from Chrome' part is what I'm interested in.

Here's the exiftool output that I see for the original source image:

```

Code Select Expand

$ ./exiftool -api RequestAll=2 ~/Downloads/IMG_1918.JPG
                                     
ExifTool Version Number        : 12.64
Now                            : 2023:07:24 22:28:57-07:00
New GUID                        : 20230724-2228-5700-4B53-003C7E0FB581
File Sequence                  : 0
File Name                      : IMG_1918.JPG
Base Name                      : IMG_1918
Directory                      : /home/raleigh/Downloads
File Path                      : /home/raleigh/Downloads/IMG_1918.JPG
File Size                      : 403 kB
File Modification Date/Time    : 2023:07:24 22:25:34-07:00
File Access Date/Time          : 2023:07:24 22:25:47-07:00
File Inode Change Date/Time    : 2023:07:24 22:25:34-07:00
File Permissions                : -rw-rw-r--
File Attributes                : Regular; (none)
File Device Number              : 66307
File Inode Number              : 20192148
File Hard Links                : 1
File User ID                    : raleigh
File Group ID                  : raleigh
File Device ID                  : 0.0
File Block Size                : 4096
File Block Count                : 792
File Type                      : JPEG
File Type Extension            : jpg
MIME Type                      : image/jpeg
JFIF Version                    : 1.01
Exif Byte Order                : Big-endian (Motorola, MM)
X Resolution                    : 72
Y Resolution                    : 72
Resolution Unit                : inches
Y Cb Cr Positioning            : Centered
Exif Version                    : 0221
Components Configuration        : Y, Cb, Cr, -
Flashpix Version                : 0100
Color Space                    : sRGB
Exif Image Width                : 2000
Exif Image Height              : 1334
Scene Capture Type              : Standard
Compression                    : JPEG (old-style)
Thumbnail Offset                : 304
Thumbnail Length                : 7857
Image Width                    : 2000
Image Height                    : 1334
Encoding Process                : Progressive DCT, Huffman coding
Bits Per Sample                : 8
Color Components                : 3
Y Cb Cr Sub Sampling            : YCbCr4:2:0 (2 2)
Image Size                      : 2000x1334
Megapixels                      : 2.7
Thumbnail Image                : (Binary data 7857 bytes, use -b option to extract)
Processing Time                : 0.00303 s
```

Nothing in this output indicates what application it was saved from, which leads me again to wonder if this info was stored in EXIF data or if it was stored elsewhere on the device.

[StarGeek]

When I go into the Gallery, I see "Saved from Chrome" on the image: https://i.imgur.com/BA6tWW4.jpg

This is almost certainly something saved either in a database by gallery or as part of the underlying file system, most likely the latter.  Editing downloaded images without permission would be a very bad idea for any type of browser.

Chromium based browsers, such as Chrome, Opera, and MS Edge, will save some data related to the download in the file system based tags. I think Firefox based ones do the same.  On Mac I would assume it's the XAttr*/MDItem* tags.  On Windows, it's saved in an Alternate Data Stream (ADS).  There recently was a person who needed to access this information and a config file was created to do so.  You can see the example output on that post to see what is saved on Windows.

I have no idea how the IOS file system works, so I can't comment further on that.

[wywh]

downloading images on iOS

Yes. But I don't know how to inspect an image with exiftool straight after it is downloaded in iOS (Safari, Chrome or other application) before moving, copying or sending it elsewhere which might delete extended attributes. So I used Safari in macOS assuming it behaves the same as iOS.

The application that downloaded the file seems to be in MacOS:XAttrQuarantine. I don't know if other OSs can display that macOS info.

Code Select Expand

[MacOS]         XAttrQuarantine                 : Flags=0083 set at 2023:07:24 08:23:06 by Safari B6D39EC2-21FD-4D92-B982-BD712575CEDE
How did you try to access the "Saved from Chrome" file with exiftool?? It seems it is not possible to use the Terminal and exiftool in iOS mount point in macOS without a jailbreak. My attempts to do that in Windows 10 via VMWare Fusion and File Explorer > Apple iPhone > Internal Storage > DCIM > YYYYMM_ also failed. Can exiftool be used when booted in iOS to access such freshly downloaded files?

I'd use something like this to inspect almost all tags:

Code Select Expand

exiftool -a -G1 -s -n -ee -api LargeFileSupport=1 -api RequestAll=2 .
I care about my Finder color tags that I use for organizing (Finder comments needed 3rd party apps in System 6-9 to survive the "Desktop rebuild" so I have never really used them).

But a few days ago I noticed a stubborn Finder Description and Keywords although I nuked IPTC and XMP tags and then almost all possible metadata. In the end I found those offending tags hiding in MacOS:MDItemDescription and MacOS:MDItemKeywords among MacOS:XAttrMDItemWhereFroms that -api RequestAll=2 could reveal.

An introduction to extended attributes, xattrs:

https://eclecticlight.co/2017/12/11/an-introduction-to-extended-attributes-xattrs/

- Matti