RetrievalP Get it for Windows

RetrievalP / Guides

Where deleted iPhone photos still hide: the image cache

By RetrievalP · Updated

The short answer: the iPhone keeps a small preview copy of every photo in its library in an internal image cache, so the Photos grid can scroll without opening the full-size files. When a photo is deleted for good, iOS destroys its original but often leaves the cached preview behind until the space is needed. That preview is frequently the only version of the photo left anywhere.

Why the cache exists

A modern iPhone photo is several megabytes. Showing hundreds of them at once in the Photos grid by opening each original would be far too slow. So, when a photo is added to the library, iOS makes a set of preview copies at the sizes the interface needs and stores them together in large cache files. Scrolling the grid reads from these files, not from the originals.

The cache lives inside the phone's photo storage, in the PhotoData/Thumbnails folder. Forensic examiners know its files by their extension, .ithmb. Each file holds many previews of the same size packed into fixed slots, compressed with a GPU texture format (ASTC on current iPhones) so they can go straight to the screen.

What happens when you delete a photo

  1. You delete it. The photo moves to Recently Deleted. Nothing is removed yet.
  2. About 30 days pass, or you empty Recently Deleted. The photo is removed from the library database, and iOS destroys the encryption key of the original file. From that moment the original is unreadable by anyone.
  3. The preview stays in its slot. Rewriting the big cache file for every deletion would be wasteful, so the slot is simply marked free. The pixels remain until a new photo needs that slot.

How long a slot survives depends on how the phone is used afterwards: how many new photos come in and how the system manages its cache. That's why there's no fixed time limit, and why using the phone less after a deletion helps.

A photo's original and its cached preview, from in the library, to deleted for good, to the slot being reused. 1. In your library 2. Deleted for good 3. Slot reused Original fileCached preview Full size, readable Key destroyed: unreadable for good Gone Shown in the grid Still there slot marked free A newer photo's preview
Between steps 2 and 3, the cached preview is often the only copy of the photo left anywhere. That's the window RetrievalP reads.

Why the Photos app can't show them

The Photos app only shows what's in the library database. Once a photo is gone from the database, nothing points to its preview any more. There's no setting, hidden album or trick on the phone that lists orphaned cache slots, and the phone's file system isn't open to apps on the phone itself.

How a computer reads it

Over USB, a trusted computer can use Apple's file service for the photo storage area, the same one Windows and Mac use to import photos. That gives read access to the cache files and the library database. Recovering the deleted photos then takes three steps:

RetrievalP does all three on Windows, read-only, without changing anything on the phone. Its free preview scan shows how many deleted photos are still in your cache before you pay anything.

How big the recovered photos are

Most cached previews are around 120 pixels across, the size of a square in the Photos grid. For some photos the phone also keeps a larger preview, up to 640 pixels, and finished edits can be kept at full size. Recovered previews are clear at the size you saw them in Photos and right for keeping and sharing, though not for enlarging or printing.

What about older guides and iThmb converters?

Older forensic guides describe pulling .ithmb files out of an iTunes backup and opening them with a converter. That worked on old iPods and early iPhones, whose cache used simple uncompressed formats. On current iPhones the previews are ASTC-compressed, the slot layouts differ between sizes and iOS versions, so those converters can't decode them.

More guides