🚨BREAKING NEWS : Your "deleted" photos aren't deleted.
Claude Code found years of them sitting in a hidden cache on my iPhone.
I plugged my iPhone into my MacBook to run a backup. I had Claude Code doing a security check at the same time. It flagged something I wasn't looking for. A directory called PhotoData/Thumbnails.
Thousands of files. Photos, videos, screenshots. A lot of them were things I had deleted.
Photos from a couple of years ago. Screenshots I took and deleted a few seconds later. Stuff I went into Recently Deleted and cleared. Some of it was still sitting there.
What I found in that cache:
- old screenshots of banking apps
- photos I deleted right after taking them
- random pictures I didn't want on my phone anymore
- a few things I specifically remember deleting more than once
When you delete a photo on iPhone, iOS removes it from your camera roll and Recently Deleted folder. But it keeps a compressed copy in a Spotlight search cache so your phone can still find things when you search. That cache doesn't get fully cleared.
I checked which apps had Files and Folders access. There were more than I expected, including apps I downloaded a long time ago and forgot about. Any of them could potentially read files from that cache.
I went through the list and removed access from most of them.
The prompt I used is below. It doesn't take long if you already have a backup.
How many apps on your phone have Files access right now?
Forem
@0xForem
I made an unencrypted local backup of my own iPhone in Finder. Help me look for leftover photos and thumbnails of pictures I deleted.
1. Find the newest backup folder in ~/Library/Application Support/MobileSync/Backup/ and confirm it is not encrypted (check Manifest.plist).
2. Open Manifest.db with sqlite3 and list every file whose relativePath contains "PhotoData", "Thumbnails", "DCIM" or "Photos.sqlite". Show counts by folder.
3. Copy Photos.sqlite to a temp folder and query the ZASSET table for items where ZTRASHEDSTATE = 1 (Recently Deleted). Show filename, date and type (photo/video).
4. Copy every thumbnail and media file you found into ~/Desktop/photo_audit/, renamed with their original names, using the fileID hash path inside the backup.
5. At the end print a summary: how many files found, how many are in Recently Deleted, how many are thumbnails, and the oldest and newest dates.
Only read from the backup. Do not modify or delete anything in it.
1. Find the newest backup folder in ~/Library/Application Support/MobileSync/Backup/ and confirm it is not encrypted (check Manifest.plist).
2. Open Manifest.db with sqlite3 and list every file whose relativePath contains "PhotoData", "Thumbnails", "DCIM" or "Photos.sqlite". Show counts by folder.
3. Copy Photos.sqlite to a temp folder and query the ZASSET table for items where ZTRASHEDSTATE = 1 (Recently Deleted). Show filename, date and type (photo/video).
4. Copy every thumbnail and media file you found into ~/Desktop/photo_audit/, renamed with their original names, using the fileID hash path inside the backup.
5. At the end print a summary: how many files found, how many are in Recently Deleted, how many are thumbnails, and the oldest and newest dates.
Only read from the backup. Do not modify or delete anything in it.
7:40 PM UTC · Oct 25, 2026 · 97.1K Views
827412879