[request] preserve/append additional file attributes

[rb0022]

Preserve/append additional file attributes, as performed by macOS

Options on macOS to obtain files and brief inspection of the file attributes:

• macOS Finder app (previously iTunes), perform unencrypted backup. Run an extractor.
• macOS Photo app, transfer files to ~/Pictures/PhotoLibrary. Loss of original filenames (and poor subdir structure), preserves Created/Modified Date and Longitude/Latitude.
• macOS Image Capture app, transfers to selected directory. Preserve original filename and Created/Modified Date.

Options on Windows:

• Windows Apple Devices app, perform unencrypted backup. Run an extractor.
• Windows Photo app, "Import From a USB device" - preserve original filenames and lose file attributes?
• Windows Explorer via MTP connection, loss of all file attributes?

Additional/available File Attributes list, as seen in the backup metadata structure (@joz-k please edit this list):

• Latitude
• Longitude
• ????

[joz-k]

@rb0022: Thanks for the analysis. Really appreciated!
I'll look into the missing MacOS attributes over the next few days. I suspect that the latitude/longitude data is related to GPS positioning, which was previously disabled on my phone :) I'll turn on GPS stamping and see what happens.

[Box333]

Thats fantastic ! Thank you for this enhancement 👍🏻

[joz-k]

could you also add a "original" parameter to the --format switch, so that the photos can be extracted to their original folder structure \Media\DCIM\Apple101, \Media\DCIM\Apple102 ...etc? Thanks

@Box333: This sounds interesting but could you please report it as a separate request? Thx.

[joz-k]

I just noticed, that the timestamp on some extracted files is shifted +1hour.. Trying to figure out why only some files are affected and not all.

@Box333: Again, this doesn't belong to this request (which is about additional file attributes). Please add this comment to #4 .

[joz-k]

@rb0022: I did a little research after enabling the iPhone Camera app to add GPS information to each photo. Apparently, even when transferring photos via AirDrop/iCloud or any other Apple native method, latitude and longitude metadata information is not added as "APFS Extended Attributes".

You can use xattr command to list all file attributes like this:

xattr -l example.heic

In case of photo downloaded to Photos app by any Apple method, I can see following extended attributes added the the media file:

com.apple.lastuseddate#PS
com.apple.macl
com.apple.metadata:kMDItemDownloadedDate
com.apple.metadata:kMDItemWhereFroms
com.apple.metadata:kMDLabel_...
com.apple.quarantine

Latitude and Longitude information is added as Exif data and is correctly preserved for each media file.

Could you send me the output of the xattr command on the file that you believe contains the longitude/latitude metadata file system attributes?

[rb0022]

@joz-k I used an extreme example (photo taken on an iPhone 3G over a decade ago) that still existed on the device and ran various data analysis tools on files extracted on macOS. See messages below for your reference, and note the listed ❗❗❗ where differences occur on the timestamp.

[rb0022]

sips

	finder + ios_backup_extractor	image cap app	photos app
pixelWidth	1600	1600	1600
pixelHeight	1200	1200	1200
typeIdentifier	public.jpeg	public.jpeg	public.jpeg
format	jpeg	jpeg	jpeg
formatOptions	default	default	default
dpiWidth	72	72	72
dpiHeight	72	72	72
samplesPerPixel	3	3	3
bitsPerSample	8	8	8
hasAlpha	no	no	no
space	RGB	RGB	RGB
profile	sRGB IEC61966-2.1	sRGB IEC61966-2.1	sRGB IEC61966-2.1
creation	2009:10:17 19:12:47	2009:10:17 19:12:47	2009:10:17 19:12:47
make	Apple	Apple	Apple
model	iPhone 3G	iPhone 3G	iPhone 3G
software	3.1.2	3.1.2	3.1.2

[rb0022]

mdls

	finder + ios_backup_extractor	image cap app	photos app
_kMDItemDisplayNameWithExtensions	2009_10_17_IMG_0362.jpg	IMG_0362.JPG	AA0C998B-1D39-4803-BE55-7A14BCE190E8.jpeg
kMDItemAcquisitionMake	Apple	Apple	Apple
kMDItemAcquisitionModel	iPhone 3G	iPhone 3G	iPhone 3G
kMDItemAperture	2.970853574	2.970853574	2.970853574
kMDItemBitsPerSample	24	24	24
kMDItemColorSpace	RGB	RGB	RGB
kMDItemContentCreationDate	2009-10-17 18:12:47 +0000	2009-10-17 18:12:47 +0000	2009-10-17 18:12:47 +0000
kMDItemContentCreationDate_Ranking	2009-10-17 00:00:00 +0000	2009-10-17 00:00:00 +0000	2009-10-17 00:00:00 +0000
kMDItemContentModificationDate	2009-10-17 18:12:47 +0000	2009-10-17 18:12:47 +0000	2009-10-17 18:12:47 +0000
kMDItemDateAdded	2025-01-02 16:22:34 +0000	2025-01-02 00:48:54 +0000	2025-01-02 00:56:20 +0000
kMDItemFSContentChangeDate ❗❗❗	2009-10-17 18:12:00 +0000	2009-10-17 18:12:47 +0000	2009-10-17 18:12:47 +0000
kMDItemFSCreationDate ❗❗❗	2009-10-17 18:12:00 +0000	2009-10-17 18:12:47 +0000	2009-10-17 18:12:47 +0000
kMDItemInterestingDate_Ranking ❗❗❗	2009-10-17 00:00:00 +0000	2025-01-02 00:00:00 +0000	2025-01-02 00:00:00 +0000
kMDItemContentType	public.jpeg	public.jpeg	public.jpeg
kMDItemContentTypeTree	("public.jpeg", "public.image", "public.data", "public.item", "public.content")	("public.jpeg", "public.image", "public.data", "public.item", "public.content")	("public.jpeg", "public.image", "public.data", "public.item", "public.content")
kMDItemCreator	3.1.2	3.1.2	3.1.2
kMDItemDisplayName	2009_10_17_IMG_0362.jpg	IMG_0362.JPG	AA0C998B-1D39-4803-BE55-7A14BCE190E8.jpeg
kMDItemDocumentIdentifier	0	0	0
kMDItemEXIFVersion	2.2.1	2.2.1	2.2.1
kMDItemExposureMode	0	0	0
kMDItemExposureProgram	2	2	2
kMDItemFlashOnOff	0	0	0
kMDItemFNumber	2.8	2.8	2.8
kMDItemFSCreatorCode
kMDItemFSFinderFlags	0	0	0
kMDItemFSHasCustomIcon	(null)	(null)	(null)
kMDItemFSInvisible	0	0	0
kMDItemFSIsExtensionHidden	0	0	0
kMDItemFSIsStationery	(null)	(null)	(null)
kMDItemFSLabel	0	0	0
kMDItemFSName	2009_10_17_IMG_0362.jpg	IMG_0362.JPG	AA0C998B-1D39-4803-BE55-7A14BCE190E8.jpeg
kMDItemFSNodeCount	(null)	(null)	(null)
kMDItemFSOwnerGroupID	20	20	20
kMDItemFSOwnerUserID	501	501	501
kMDItemFSSize	802673	802673	802673
kMDItemFSTypeCode
kMDItemGPSDateStamp	2009:10:17	2009:10:17	2009:10:17
kMDItemHasAlphaChannel	0	0	0
kMDItemKind	JPEG image	JPEG image	JPEG image
kMDItemLatitude	50.92716667	50.92716667	50.92716667
kMDItemLogicalSize	802673	802673	802673
kMDItemLongitude	-1.39	-1.39	-1.39
kMDItemMeteringMode	1	1	1
kMDItemOrientation	1	1	1
kMDItemPhysicalSize	802816	802816	802816
kMDItemPixelCount	1920000	1920000	1920000
kMDItemPixelHeight	1600	1600	1600
kMDItemPixelWidth	1200	1200	1200
kMDItemProfileName	sRGB IEC61966-2.1	sRGB IEC61966-2.1	sRGB IEC61966-2.1
kMDItemRedEyeOnOff	0	0	0
kMDItemResolutionHeightDPI	72	72	72
kMDItemResolutionWidthDPI	72	72	72
kMDItemTimestamp	19:12:17	19:12:17	19:12:17
kMDItemWhiteBalance	0	0	0

[rb0022]

exiftool

	finder + ios_backup_extractor	image cap app	photos app
ExifTool Version Number	13.1	13.1	13.1
File Name	2009_10_17_IMG_0362.jpg	IMG_0362.JPG	AA0C998B-1D39-4803-BE55-7A14BCE190E8.jpeg
Directory	.	.	.
File Size	803 kB	803 kB	803 kB
File Modification Date/Time ❗❗❗	2009:10:17 19:12:00+01:00	2009:10:17 19:12:47+01:00	2009:10:17 19:12:47+01:00
File Access Date/Time	2025:01:02 16:22:36+00:00	2025:01:02 00:50:03+00:00	2025:01:02 00:56:43+00:00
File Inode Change Date/Time	2025:01:02 16:22:34+00:00	2025:01:02 00:50:03+00:00	2025:01:02 00:56:43+00:00
File Permissions	-rw-r--r--	-rw-------	-rw-------
File Type	JPEG	JPEG	JPEG
File Type Extension	jpg	jpg	jpg
MIME Type	image/jpeg	image/jpeg	image/jpeg
Exif Byte Order	Big-endian (Motorola, MM)	Big-endian (Motorola, MM)	Big-endian (Motorola, MM)
Make	Apple	Apple	Apple
Camera Model Name	iPhone 3G	iPhone 3G	iPhone 3G
Orientation	Rotate 270 CW	Rotate 270 CW	Rotate 270 CW
X Resolution	72	72	72
Y Resolution	72	72	72
Resolution Unit	inches	inches	inches
Software	3.1.2	3.1.2	3.1.2
Modify Date	2009:10:17 19:12:47	2009:10:17 19:12:47	2009:10:17 19:12:47
Y Cb Cr Positioning	Centered	Centered	Centered
F Number	2.8	2.8	2.8
Exposure Program	Program AE	Program AE	Program AE
Exif Version	221	221	221
Date/Time Original	2009:10:17 19:12:47	2009:10:17 19:12:47	2009:10:17 19:12:47
Create Date	2009:10:17 19:12:47	2009:10:17 19:12:47	2009:10:17 19:12:47
Components Configuration	Y, Cb, Cr, -	Y, Cb, Cr, -	Y, Cb, Cr, -
Aperture Value	2.8	2.8	2.8
Metering Mode	Average	Average	Average
Flash	No flash function	No flash function	No flash function
Flashpix Version	100	100	100
Color Space	sRGB	sRGB	sRGB
Exif Image Width	1600	1600	1600
Exif Image Height	1200	1200	1200
Sensing Method	One-chip color area	One-chip color area	One-chip color area
Exposure Mode	Auto	Auto	Auto
White Balance	Auto	Auto	Auto
GPS Latitude Ref	North	North	North
GPS Longitude Ref	West	West	West
GPS Time Stamp	12:17.9	12:17.9	12:17.9
Compression	JPEG (old-style)	JPEG (old-style)	JPEG (old-style)
Thumbnail Offset	714	714	714
Thumbnail Length	13339	13339	13339
Image Width	1600	1600	1600
Image Height	1200	1200	1200
Encoding Process	Baseline DCT, Huffman coding	Baseline DCT, Huffman coding	Baseline DCT, Huffman coding
Bits Per Sample	8	8	8
Color Components	3	3	3
Y Cb Cr Sub Sampling	YCbCr4:2:0 (2 2)	YCbCr4:2:0 (2 2)	YCbCr4:2:0 (2 2)
Aperture	2.8	2.8	2.8
Image Size	1600x1200	1600x1200	1600x1200
Megapixels	1.9	1.9	1.9
Thumbnail Image	(Binary data 13339 bytes, use -b option to extract)	(Binary data 13339 bytes, use -b option to extract)	(Binary data 13339 bytes, use -b option to extract)
GPS Latitude	50 deg 55' 37.80" N	50 deg 55' 37.80" N	50 deg 55' 37.80" N
GPS Longitude	1 deg 23' 24.00" W	1 deg 23' 24.00" W	1 deg 23' 24.00" W
GPS Position	50 deg 55' 37.80" N, 1 deg 23' 24.00" W	50 deg 55' 37.80" N, 1 deg 23' 24.00" W	50 deg 55' 37.80" N, 1 deg 23' 24.00" W

[rb0022]

xattr

	finder + ios_backup_extractor	image cap app	photos app
com.apple.assetsd.UUID			9H Uz
com.apple.assetsd.addedDate			bplist003A
com.apple.assetsd.assetType
com.apple.assetsd.avalanche.type
com.apple.assetsd.cloudAsset.UUID			AA0C998B-aaaa-….
com.apple.assetsd.creatorBundleID			com.apple.Photos
com.apple.assetsd.customCreationDate			bplist003A@
com.apple.assetsd.customLocation			(evI@=p=
p=			3864C76E-aaaa-….
com.apple.assetsd.dbRebuildUuid
com.apple.assetsd.deferredProcessing
com.apple.assetsd.favorite
com.apple.assetsd.hidden
com.apple.assetsd.importedBy			Photos
com.apple.assetsd.importedByDisplayName			bplist00
com.apple.assetsd.libraryScopeAssetContributorsToUpdate
X$versionY$archiverT$topX$objects
com.apple.assetsd.libraryScopeShareState			IMG_0362.JPG
com.apple.assetsd.originalFilename
com.apple.assetsd.sceneAnalysisIsFromPreivew
com.apple.assetsd.syndicationHistory			Europe/London
com.apple.assetsd.timeZoneName
com.apple.assetsd.timeZoneOffset
com.apple.assetsd.trashed
com.apple.assetsd.trashedReason
com.apple.assetsd.videoComplementVisibility			Kug
com.apple.lastuseddate#PS		ug	0082;672bb057;Photos;
com.apple.quarantine		0082; 6775e241; Preview;

[rb0022]

imagemagick identify

	finder + ios_backup_extractor	image cap app	photos app
Image
Filename	2009_10_17_IMG_0362.jpg	IMG_0362.JPG	AA0C998B-1D39-4803-BE55-7A14BCE190E8.jpeg
Permissions	rw-r--r--	rw-------	rw-------
Format	JPEG (Joint Photographic Experts Group JFIF format)	JPEG (Joint Photographic Experts Group JFIF format)	JPEG (Joint Photographic Experts Group JFIF format)
Mime type	image/jpeg	image/jpeg	image/jpeg
Class	DirectClass	DirectClass	DirectClass
Geometry	1600x1200+0+0	1600x1200+0+0	1600x1200+0+0
Resolution	72x72	72x72	72x72
Print size	22.2222x16.6667	22.2222x16.6667	22.2222x16.6667
Units	PixelsPerInch	PixelsPerInch	PixelsPerInch
Colorspace	sRGB	sRGB	sRGB
Type	TrueColor	TrueColor	TrueColor
Endianness	Undefined	Undefined	Undefined
Depth	8-bit	8-bit	8-bit
Compression	JPEG	JPEG	JPEG
Quality	96	96	96
Orientation	LeftBottom	LeftBottom	LeftBottom
Profiles
Profile-exif	14047 bytes	14047 bytes	14047 bytes
Properties
date	date:create: 2025-01-02T16:22:34+00:00	date:create: 2025-01-02T00:50:03+00:00	date:create: 2025-01-02T00:56:43+00:00
date ❗❗❗	date:modify: 2009-10-17T18:12:00+00:00	date:modify: 2009-10-17T18:12:47+00:00	date:modify: 2009-10-17T18:12:47+00:00
date	date:timestamp: 2025-01-02T17:35:22+00:00	date:timestamp: 2025-01-02T17:37:14+00:00	date:timestamp: 2025-01-02T17:36:52+00:00
exif	exif:ApertureValue: 4281/1441	exif:ApertureValue: 4281/1441	exif:ApertureValue: 4281/1441
exif	exif:ColorSpace: 1	exif:ColorSpace: 1	exif:ColorSpace: 1
exif	exif:ComponentsConfiguration: ...	exif:ComponentsConfiguration: ...	exif:ComponentsConfiguration: ...
exif	exif:DateTime: 2009:10:17 19:12:47	exif:DateTime: 2009:10:17 19:12:47	exif:DateTime: 2009:10:17 19:12:47
exif	exif:DateTimeDigitized: 2009:10:17 19:12:47	exif:DateTimeDigitized: 2009:10:17 19:12:47	exif:DateTimeDigitized: 2009:10:17 19:12:47
exif	exif:DateTimeOriginal: 2009:10:17 19:12:47	exif:DateTimeOriginal: 2009:10:17 19:12:47	exif:DateTimeOriginal: 2009:10:17 19:12:47
exif	exif:ExifOffset: 204	exif:ExifOffset: 204	exif:ExifOffset: 204
exif	exif:ExifVersion: 0221	exif:ExifVersion: 0221	exif:ExifVersion: 0221
exif	exif:ExposureMode: 0	exif:ExposureMode: 0	exif:ExposureMode: 0
exif	exif:ExposureProgram: 2	exif:ExposureProgram: 2	exif:ExposureProgram: 2
exif	exif:Flash: 32	exif:Flash: 32	exif:Flash: 32
exif	exif:FlashPixVersion: 0100	exif:FlashPixVersion: 0100	exif:FlashPixVersion: 0100
exif	exif:FNumber: 14/5	exif:FNumber: 14/5	exif:FNumber: 14/5
exif	exif:GPSInfo: 458	exif:GPSInfo: 458	exif:GPSInfo: 458
exif	exif:GPSLatitude: 50/1,5563/100,0/1	exif:GPSLatitude: 50/1,5563/100,0/1	exif:GPSLatitude: 50/1,5563/100,0/1
exif	exif:GPSLatitudeRef: N	exif:GPSLatitudeRef: N	exif:GPSLatitudeRef: N
exif	exif:GPSLongitude: 1/1,2340/100,0/1	exif:GPSLongitude: 1/1,2340/100,0/1	exif:GPSLongitude: 1/1,2340/100,0/1
exif	exif:GPSLongitudeRef: W	exif:GPSLongitudeRef: W	exif:GPSLongitudeRef: W
exif	exif:GPSTimeStamp: 19/1,12/1,1793/100	exif:GPSTimeStamp: 19/1,12/1,1793/100	exif:GPSTimeStamp: 19/1,12/1,1793/100
exif	exif:Make: Apple	exif:Make: Apple	exif:Make: Apple
exif	exif:MeteringMode: 1	exif:MeteringMode: 1	exif:MeteringMode: 1
exif	exif:Model: iPhone 3G	exif:Model: iPhone 3G	exif:Model: iPhone 3G
exif	exif:PixelXDimension: 1600	exif:PixelXDimension: 1600	exif:PixelXDimension: 1600
exif	exif:PixelYDimension: 1200	exif:PixelYDimension: 1200	exif:PixelYDimension: 1200
exif	exif:SensingMethod: 2	exif:SensingMethod: 2	exif:SensingMethod: 2
exif	exif:Software: 3.1.2	exif:Software: 3.1.2	exif:Software: 3.1.2
exif	exif:thumbnail:Compression: 6	exif:thumbnail:Compression: 6	exif:thumbnail:Compression: 6
exif	exif:thumbnail:JPEGInterchangeFormat: 702	exif:thumbnail:JPEGInterchangeFormat: 702	exif:thumbnail:JPEGInterchangeFormat: 702
exif	exif:thumbnail:JPEGInterchangeFormatLength: 13339	exif:thumbnail:JPEGInterchangeFormatLength: 13339	exif:thumbnail:JPEGInterchangeFormatLength: 13339
exif	exif:thumbnail:Orientation: 8	exif:thumbnail:Orientation: 8	exif:thumbnail:Orientation: 8
exif	exif:thumbnail:ResolutionUnit: 2	exif:thumbnail:ResolutionUnit: 2	exif:thumbnail:ResolutionUnit: 2
exif	exif:thumbnail:XResolution: 72/1	exif:thumbnail:XResolution: 72/1	exif:thumbnail:XResolution: 72/1
exif	exif:thumbnail:YResolution: 72/1	exif:thumbnail:YResolution: 72/1	exif:thumbnail:YResolution: 72/1
exif	exif:WhiteBalance: 0	exif:WhiteBalance: 0	exif:WhiteBalance: 0
exif	exif:YCbCrPositioning: 1	exif:YCbCrPositioning: 1	exif:YCbCrPositioning: 1
jpeg	jpeg:colorspace: 2	jpeg:colorspace: 2	jpeg:colorspace: 2
jpeg	jpeg:sampling-factor: 2x2,1x1,1x1	jpeg:sampling-factor: 2x2,1x1,1x1	jpeg:sampling-factor: 2x2,1x1,1x1
signature	signature: 3ae….	signature: 3ae….	signature: 3ae….
Filesize	802673B	802673B	802673B
Number pixels	1.92M	1.92M	1.92M

[joz-k]

@rb0022 Thank you for this excellent and detailed analysis! This is awesome.

I can clearly see that this tool is not able to set various timestamps to a more detailed precision than minutes. It's probably caused by the API used on MacOS (as mentioned in older issue). I may be able to fix this at some point in the future by rewriting this utility in a different programming language (where it is easier to call the native APIs). However, I don't think this is a high priority issue.

As with other extended MacOS attributes, everything under the com.apple. domain is Apple-specific and not officially documented. No application other than Apple's own should set these attributes.

Do you think (after your really excellent analysis) that there is anything else that needs to be done to set more attributes on MacOS besides timestamps that are not accurate to the second?

[rb0022]

@joz-k The analysis thankfully confirms that everything matches, and is just to remain here for your reference.

I agree with ignoring com.apple.* xattr.

I would suggest to create an issue that tracks the "[bug] timestamp seconds not set by extractor on macos" (preferably without forcing a rewrite to some other OS indep like Python, see issue 6 with URLs for other tooling - all of which is Python).

Prior to closing this issue, I would suggest your own verification (and the data table of that here) of a file extracted from a backup by Windows Apple Devices app vs. macOS Finder. The timestamp seconds will be different and can be ignored as it is a known issue, but everything else should match across the different analysis tools?

[joz-k]

The problem with timestamps not being accurate to the second is not present on Windows, since I was able to use a module that calls the correct Windows API directly.

Also, there are no extended metadata attributes on Windows FS.

I'm going to close this issue and create a new one for timestamps.