Apple Intelligence Photo Forensics: Photo Cleanup
- mrbhargavrathod
- Feb 16
- 18 min read
Updated: Mar 18

Uncover how Apple's new Apple Intelligence/AI tools are setting a new standard in photo editing and forensic analysis!
Background:
I was just playing around with Apple's Image Playground and Photo Cleanup. Curiosity got the best of me, and I ended up writing this blog post of my experimental stuff on Apple Intelligence Photo Forensics!
I clicked a photo with my iPhone while I was travelling to Bangkok (Refer to Fig 1 below). This is one of the famous spots/tourist attractions for food lovers in Bangkok :)

Original Image analysis:
Extended attributes analysis:
As this photo was captured on an iPhone and later on dropped to the macOS via Airdrop, we see a bunch of extended attributes (xattr) added to the file by macOS. Refer to A1.1 below
The important extended attributes are:
com.apple.assetsd.importedByDisplayName:
00000000 43 61 6D 65 72 61 |Camera|
00000006com.apple.assetsd.creatorBundleID:00000000 63 6F 6D 2E 61 70 70 6C 65 2E 63 61 6D 65 72 61 00000010 |com.apple.camera|Exif data analysis:
When the photo was captured, the location data was enabled hence it captured all those location details and stored it in the Exif data of the photo. Refer to A1.2 below
The Exif data of interest to us are given below and they signify that the photo was clicked on an iPhone. I have not included that Location metadata as it may be turned on or off by the user's preference.
Host Computer          : iPhone 16
Lens Make            : Apple
Lens Model           : iPhone 16 back dual wide camera 5.96mm f/1.6
Lens ID Â Â Â Â Â Â Â Â Â Â Â Â : iPhone 16 back dual wide camera 5.96mm f/1.6Extended attributes and Exif data of the originally captured photo:
A1.1 - Original Photo extended attributes
com.apple.assetsd.UUID:
00000000 73 65 42 3A 82 CE 45 3B 9A 13 F2 0D 04 C5 8F 0A |seB:..E;........|
00000010
com.apple.assetsd.addedDate:
00000000 62 70 6C 69 73 74 30 30 33 41 C6 73 B2 EC C4 80 |bplist003A.s....|
00000010 D0 08 00 00 00 00 00 00 01 01 00 00 00 00 00 00 |................|
00000020 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000030 00 11 |..|
00000032
com.apple.assetsd.assetType:
00000000 03 00 |..|
00000002
com.apple.assetsd.avalanche.type:
00000000 00 00 |..|
00000002
com.apple.assetsd.cloudAsset.UUID:
00000000 37 33 36 35 34 32 33 41 2D 38 32 43 45 2D 34 35 |7XXXXXXX-82CE-45|
00000010 33 42 2D 39 41 31 33 2D 46 32 30 44 30 34 43 35 |3B-XXXX-FXXXXX5|
00000020 38 46 30 41 |8F0A|
00000024
com.apple.assetsd.creatorBundleID:
00000000 63 6F 6D 2E 61 70 70 6C 65 2E 63 61 6D 65 72 61 |com.apple.camera|
00000010
com.apple.assetsd.currentSleetCast:
00000000 01 00 |..|
00000002
com.apple.assetsd.customCreationDate:
00000000 62 70 6C 69 73 74 30 30 33 41 C6 73 B2 EC A0 20 |bplist003A.s... |
00000010 C5 08 00 00 00 00 00 00 01 01 00 00 00 00 00 00 |................|
00000020 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000030 00 11 |..|
00000032
com.apple.assetsd.customLocation:
00000000 29 8E 16 7A D7 83 2B 40 FA 34 14 64 F1 1F 59 40 |)..z..+@.4.d..Y@|
00000010 71 5E 1E FE D6 81 1B 40 00 6F 4C 9F D1 DD 35 40 |q^.....@.oL...5@|
00000020 00 00 00 00 00 00 00 00 04 76 EA DF 72 70 74 40 |.........v..rpt@|
00000030 00 00 00 00 00 00 00 00 00 00 00 EC B2 73 C6 41 |.............s.A|
00000040
com.apple.assetsd.dbRebuildUuid:
00000000 36 34 34 37 45 37 36 37 2D 30 35 36 36 2D 34 33 |6447E767-0566-43|
00000010 37 33 2D 42 30 31 32 2D 38 32 46 33 43 31 31 38 |73-B012-82F3C118|
00000020 43 30 39 41 |C09A|
00000024
com.apple.assetsd.deferredProcessing:
00000000 00 00 |..|
00000002
com.apple.assetsd.favorite:
00000000 00 00 |..|
00000002
com.apple.assetsd.hidden:
00000000 00 00 |..|
00000002
com.apple.assetsd.importedBy:
00000000 01 00 |..|
00000002
com.apple.assetsd.importedByDisplayName:
00000000 43 61 6D 65 72 61 |Camera|
00000006
com.apple.assetsd.libraryScopeAssetContributorsToUpdate:
00000000 62 70 6C 69 73 74 30 30 D4 01 02 03 04 05 06 07 |bplist00........|
00000010 0A 58 24 76 65 72 73 69 6F 6E 59 24 61 72 63 68 |.X$versionY$arch|
00000020 69 76 65 72 54 24 74 6F 70 58 24 6F 62 6A 65 63 |iverT$topX$objec|
00000030 74 73 12 00 01 86 A0 5F 10 0F 4E 53 4B 65 79 65 |ts....._..NSKeye|
00000040 64 41 72 63 68 69 76 65 72 D1 08 09 54 72 6F 6F |dArchiver...Troo|
00000050 74 80 00 A1 0B 55 24 6E 75 6C 6C 08 11 1A 24 29 |t....U$null...$)|
00000060 32 37 49 4C 51 53 55 00 00 00 00 00 00 01 01 00 |27ILQSU.........|
00000070 00 00 00 00 00 00 0C 00 00 00 00 00 00 00 00 00 |................|
00000080 00 00 00 00 00 00 5B |......[|
00000087
com.apple.assetsd.libraryScopeShareState:
00000000 00 00 00 00 00 00 00 00 |........|
00000008
com.apple.assetsd.originalFilename:
00000000 49 4D 47 5F 30 30 31 32 2E 48 45 49 43 |IMG_0012.HEIC|
0000000D
com.apple.assetsd.sceneAnalysisIsFromPreivew:
00000000 00 00 |..|
00000002
com.apple.assetsd.syndicationHistory:
00000000 00 00 |..|
00000002
com.apple.assetsd.timeZoneName:
00000000 47 4D 54 2B 30 37 30 30 |GMT+0700|
00000008
com.apple.assetsd.timeZoneOffset:
00000000 70 62 00 00 |pb..|
00000004
com.apple.assetsd.trashed:
00000000 00 00 |..|
00000002
com.apple.assetsd.trashedReason:
00000000 00 00 |..|
00000002
com.apple.assetsd.videoComplementVisibility:
00000000 00 00 |..|
00000002
com.apple.assetsd.viewPresentation:
00000000 00 00 |..|
00000002
com.apple.lastuseddate#PS:
00000000 2D 40 A7 67 00 00 00 00 FD C2 19 36 00 00 00 00 |-@.g.......6....|
00000010
com.apple.quarantine:
00000000 30 30 38 31 3B 36 37 61 37 34 30 32 64 3B 73 68 |0081;67a7402d;sh|
00000010 61 72 69 6E 67 64 3B 34 33 36 33 37 37 39 33 2D |aringd;XXXX793-|
00000020 42 38 34 32 2D 34 34 42 38 2D 39 37 33 45 2D 46 |B842-44B8-973E-F|
00000030 41 45 44 31 35 30 43 41 34 32 30 |AED150CA420|
0000003B
A1.2 - Original Photo Exif data
ExifTool Version Number     : 13.18File Name            : IMG_0012.HEICDirectory            : /Users/*/DownloadsFile Size            : 3.0 MBFile Modification Date/Time   : 2024:11:15 16:49:53+05:30File Access Date/Time      : 2025:02:09 13:40:37+05:30File Inode Change Date/Time   : 2025:02:08 16:59:49+05:30File Permissions        : -rw-r--r--File Type            : HEICFile Type Extension       : heicMIME Type            : image/heicMajor Brand           : High Efficiency Image Format HEVC still image (.HEIC)Minor Version          : 0.0.0Compatible Brands        : mif1, MiHB, MiHA, heix, MiHE, MiPr, miaf, heic, tmapHandler Type          : PicturePrimary Item Reference     : 46Meta Image Size         : 5712x4284 0 1287 4096 3072 0 516 2856 2142 0 0 64 0 0 15 16960 26 37275 15 16960 65533 56960 15 16960 26 37275 15 16960 11 53518 15 16960 0 10 15 16960 0 10 15 16960XMP Toolkit           : XMP Core 6.0.0Auxiliary Image Sub Type    : portraiteffectsmatteNative Format          : L008Stored Format          : L008Portrait Effects Matte Version : 65537Semantic Segmentation Matte Version: 65536HDR Gain Map Version      : 0.2.0.0HDR Gain Map Headroom      : 3.343157Exif Byte Order         : Big-endian (Motorola, MM)Make              : AppleCamera Model Name        : iPhone 16Orientation           : Rotate 90 CWX Resolution          : 72Y Resolution          : 72Resolution Unit         : inchesSoftware            : 18.0.1Modify Date           : 2024:11:15 18:19:53Host Computer          : iPhone 16Exposure Time          : 1/25F Number            : 1.6Exposure Program        : Program AEISO               : 500Exif Version          : 0232Date/Time Original       : 2024:11:15 18:19:53Create Date           : 2024:11:15 18:19:53Offset Time           : +07:00Offset Time Original      : +07:00Offset Time Digitized      : +07:00Shutter Speed Value       : 1/25Aperture Value         : 1.6Brightness Value        : -1.124403185Exposure Compensation      : 0Metering Mode          : Multi-segmentFlash              : Off, Did not fireFocal Length          : 6.0 mmSubject Area          : 2836 2129 3277 1875Maker Note Version       : 15Run Time Flags         : ValidRun Time Value         : 2629324449166Run Time Scale         : 1000000000Run Time Epoch         : 0AE Stable            : YesAE Target            : 135AE Average           : 130AF Stable            : YesAcceleration Vector       : 0.009677661592 -1.005830288 0.03582436219Focus Distance Range      : 0.46 - 0.46 mImage Capture Type       : SceneLive Photo Video Index     : 8595185700Photos App Feature Flags    : 0HDR Headroom          : 1.00999999AF Performance         : 268 1 21Signal To Noise Ratio      : 29.13035585Photo Identifier        : B4B41692-F2AD-436C-8F34-6DB794D3E1F7Color Temperature        : 3696Camera Type           : Back NormalFocus Position         : 54HDR Gain            : 1.854003906Sub Sec Time Original      : 251Sub Sec Time Digitized     : 251Color Space           : UncalibratedExif Image Width        : 5712Exif Image Height        : 4284Sensing Method         : One-chip color areaScene Type           : Directly photographedExposure Mode          : AutoWhite Balance          : AutoDigital Zoom Ratio       : 1.182771949Focal Length In 35mm Format   : 43 mmLens Info            : 2.220000029-5.960000038mm f/1.6-2.2Lens Make            : AppleLens Model           : iPhone 16 back dual wide camera 5.96mm f/1.6Composite Image         : General Composite ImageGPS Latitude Ref        : NorthGPS Longitude Ref        : EastGPS Altitude Ref        : Above Sea LevelGPS Time Stamp         : 11:19:52GPS Speed Ref          : km/hGPS Speed            : 0GPS Img Direction Ref      : True NorthGPS Img Direction        : 327.0280456GPS Dest Bearing Ref      : True NorthGPS Dest Bearing        : 327.0280456GPS Date Stamp         : 2024:11:15GPS Horizontal Positioning Error: 21.86647983 mColor Profiles         : nclxImage Width           : 5712Image Height          : 4284Image Spatial Extent      : 5712x4284Image Pixel Depth        : 10 10 10Red Matrix Column        : 0.51512 0.2412 -0.00105Green Matrix Column       : 0.29198 0.69225 0.04189Blue Matrix Column       : 0.1571 0.06657 0.78407Red Tone Reproduction Curve   : (Binary data 32 bytes, use -b option to extract)Blue Tone Reproduction Curve  : (Binary data 32 bytes, use -b option to extract)Green Tone Reproduction Curve  : (Binary data 32 bytes, use -b option to extract)Gray Tone Reproduction Curve  : (Binary data 14 bytes, use -b option to extract)Auxiliary Image Type      : urn:com:apple:photo:2018:aux:portraiteffectsmatteProfile CMM Type        : Apple Computer Inc.Profile Version         : 4.0.0Profile Class          : Display Device ProfileColor Space Data        : RGBProfile Connection Space    : XYZProfile Date Time        : 2024:01:01 00:00:00Profile File Signature     : acspPrimary Platform        : Apple Computer Inc.CMM Flags            : Not Embedded, IndependentDevice Manufacturer       : Apple Computer Inc.Device Model          : Device Attributes        : Reflective, Glossy, Positive, ColorRendering Intent        : PerceptualConnection Space Illuminant   : 0.9642 1 0.82491Profile Creator         : Apple Computer Inc.Profile ID           : 27a72bb01aaadc03f504deef4c429688Profile Description       : Display P3 Primaries; PQ (Gain Map Preview B0C3CA6929011C3C)Profile Copyright        : Copyright Apple Inc., 2024Media White Point        : 0.96419 1 0.82489A To B0             : (Binary data 6412 bytes, use -b option to extract)B To A0             : (Binary data 6412 bytes, use -b option to extract)Chromatic Adaptation      : 1.04788 0.02292 -0.0502 0.02959 0.99048 -0.01706 -0.00923 0.01508 0.75168Color Primaries         : SMPTE EG 432-1Transfer Characteristics    : SMPTE ST 2084, ITU BT.2100 PQMatrix Coefficients       : Identity matrixVideo Full Range Flag      : FullHD Gain Map Info        : (Binary data 230 bytes, use -b option to extract)Luminance            : 0 100 0Rotation            : Horizontal (Normal)HEVC Configuration Version   : 1General Profile Space      : ConformingGeneral Tier Flag        : Main TierGeneral Profile IDC       : Main Still PictureGen Profile Compatibility Flags : Main Still Picture, Main 10, MainConstraint Indicator Flags   : 176 0 0 0 0 0General Level IDC        : 63 (level 2.1)Min Spatial Segmentation IDC  : 0Parallelism Type        : 0Chroma Format          : 4:2:0Bit Depth Luma         : 8Bit Depth Chroma        : 8Average Frame Rate       : 0Constant Frame Rate       : UnknownNum Temporal Layers       : 1Temporal ID Nested       : NoMedia Data Size         : 3010356Media Data Offset        : 23551Run Time Since Power Up     : 0:43:49Aperture            : 1.6Image Size           : 5712x4284Megapixels           : 24.5Scale Factor To 35 mm Equivalent: 7.2Shutter Speed          : 1/25Create Date           : 2024:11:15 18:19:53.251+07:00Date/Time Original       : 2024:11:15 18:19:53.251+07:00Modify Date           : 2024:11:15 18:19:53+07:00GPS Altitude          : 6.8 m Above Sea LevelGPS Date/Time          : 2024:11:15 11:19:52ZGPS Latitude          : 13 deg 45' 27.01" NGPS Longitude          : 100 deg 29' 56.79" ECircle Of Confusion       : 0.004 mmField Of View          : 45.4 degFocal Length          : 6.0 mm (35 mm equivalent: 43.0 mm)GPS Position          : 13 deg 45' 27.01" N, 100 deg 29' 56.79" EHyperfocal Distance       : 5.33 mLight Value           : 3.7Lens ID             : iPhone 16 back dual wide camera 5.96mm f/1.6Modifying the image using Clean up feature in Photos.app:
I open this photo with the extended attributes and Exif data with Photos.app because the Photo Cleanup feature is available only inside Photos.app application in iOS and macOS.
Photo Clean Up process in Photos.app:
This section provides details on the steps involved in Photo Cleanup
Open the Photos.app and import the photo and click on Edit at the top right

Select Clean Up

Once you click the Clean Up,
If you have never visited the Clean Up module, you would need to click to download the Clean Up module which will just a few seconds as shown in the below image

Select the parts of the photo you would like to cleanup by zooming in and out.
The Clean Up module will automatically identify people from the photo and highlight them in pink which blinks. If you would like to remove it, just click on the pink blinking area.
Click save. You can either override the same image or create a new file.

After Clean Up the photo looks like this:

Fig 1.5 Photo preview after Cleanup
So, once you Clean Up the photo, the metadata and extended attributes of the photo changes!
Exif data analysis after using Clean Up:
It removed your location metadata along with your make and model data from the Exif data. Check A2.1
The Exif data of interest to us are given below and they signify that the photo
Credit : Apple Photos Clean UpDigital Source Type : http://cv.iptc.org/newscodes/digitalsourcetype/compositeWithTrainedAlgorithmicMediaThese 2 are added to the Exif data after a photo is edited using Cleanup feature inside Photos.app.
Extended attribute analysis after using Clean Up:
Photos.app is added to the com.apple.quarantine attribute replacing the sharingd as it was dropped via Airdrop.
All the other exteded attributes are just flushed out! Check A2.2 below
Exif data and Extended attribites after using Clean Up via Photos.app:
A2.1 - Image Exif data after using Cleanup
ExifTool Version Number : 13.10File Name : 161B0B91-D629-45C2-BD55-4A0F85767A81_1_201_a.heicDirectory : /Users/DownloadsFile Size : 2.4 MBFile Modification Date/Time : 2025:02:08 17:35:30+05:30File Access Date/Time : 2025:02:08 17:37:11+05:30File Inode Change Date/Time : 2025:02:08 17:37:10+05:30File Permissions : -rw-r--r--File Type : HEICFile Type Extension : heicMIME Type : image/heicMajor Brand : High Efficiency Image Format HEVC still image (.HEIC)Minor Version : 0.0.0Compatible Brands : mif1, MiHE, miaf, MiHB, heicHandler Type : PicturePrimary Item Reference : 31Meta Image Size : 4284x5712 0 514 2142 2856Exif Byte Order : Big-endian (Motorola, MM)Orientation : Horizontal (normal)XMP Toolkit : XMP Core 6.0.0Credit : Apple Photos Clean UpDigital Source Type : http://cv.iptc.org/newscodes/digitalsourcetype/compositeWithTrainedAlgorithmicMediaHDR Gain Map Version : 0.2.0.0HDR Gain Map Headroom : 3.343157Profile CMM Type : Apple Computer Inc.Profile Version : 4.0.0Profile Class : Display Device ProfileColor Space Data : RGBProfile Connection Space : XYZProfile Date Time : 2022:01:01 00:00:00Profile File Signature : acspPrimary Platform : Apple Computer Inc.CMM Flags : Not Embedded, IndependentDevice Manufacturer : Apple Computer Inc.Device Model : Device Attributes : Reflective, Glossy, Positive, ColorRendering Intent : PerceptualConnection Space Illuminant : 0.9642 1 0.82491Profile Creator : Apple Computer Inc.Profile ID : ecfda38e388547c36db4bd4f7ada182fProfile Description : Display P3Profile Copyright : Copyright Apple Inc., 2022Media White Point : 0.96419 1 0.82489Red Matrix Column : 0.51512 0.2412 -0.00105Green Matrix Column : 0.29198 0.69225 0.04189Blue Matrix Column : 0.1571 0.06657 0.78407Red Tone Reproduction Curve : (Binary data 32 bytes, use -b option to extract)Chromatic Adaptation : 1.04788 0.02292 -0.0502 0.02959 0.99048 -0.01706 -0.00923 0.01508 0.75168Blue Tone Reproduction Curve : (Binary data 32 bytes, use -b option to extract)Green Tone Reproduction Curve : (Binary data 32 bytes, use -b option to extract)Max Content Light Level : 203Max Pic Average Light Level : 64Image Width : 4284Image Height : 5712Image Spatial Extent : 4284x5712Rotation : Horizontal (Normal)Image Pixel Depth : 8 8 8Gray Tone Reproduction Curve : (Binary data 14 bytes, use -b option to extract)Auxiliary Image Type : urn:com:apple:photo:2020:aux:hdrgainmapHEVC Configuration Version : 1General Profile Space : ConformingGeneral Tier Flag : Main TierGeneral Profile IDC : Main Still PictureGen Profile Compatibility Flags : Main Still Picture, Main 10, MainConstraint Indicator Flags : 176 0 0 0 0 0General Level IDC : 93 (level 3.1)Min Spatial Segmentation IDC : 0Parallelism Type : 0Chroma Format : 4:2:0Bit Depth Luma : 8Bit Depth Chroma : 8Average Frame Rate : 0Constant Frame Rate : UnknownNum Temporal Layers : 1Temporal ID Nested : NoMedia Data Size : 2391354Media Data Offset : 3653Image Size : 4284x5712Megapixels : 24.5A2.2 - Image Extended Attributes after using Cleanup
Analyzing the Exif data after Clean Up:
Digital Source Type : http://cv.iptc.org/newscodes/digitalsourcetype/compositeWithTrainedAlgorithmicMediaGuess what happens when you open this URL!

When you open an image in Photos/Preview containing this Exif value, it is automatically parsed and shows you the tag "Modified with Clean Up" in Photos.app (both iOS and macOS) as shown in below Fig 2.1

When the same info is viewed using Preview.app as shows in Fig2.2, it shows a different output saying the below which is retreived and parsed from the "Digital Source Type" Exif data which was added after using Clean Up.
Provider: Apple Photos Clean UpDigital Source Type: Edited using Generative AI
Manipulating Exif data for fun and deceiving!
We remove the 2 Exifdata values to check if the tag/banner is removed.
First we modifyedit the Credit Exif value to "New"
This is the command used for this:
exiftool -Credit="New" /Users/malware/Downloads/2DF49D93-4ED4-45D5-B6E6-3051B34076B1_1_102_a.jpegUnsuccesful Result:
Even after changing/modifying the "Credit" exif data it still showed that the photo was cleanup
Let's edit/modify the "Digital Source Type" Exif value to "New"
This is the command used for this:
exiftool -DigitalSourceType="New" /Users/Downloads/2DF49D93-4ED4-45D5-B6E6-3051B34076B1_1_102_a.jpegSuccess and Final Result:
Wohoo! So executing both the command and editing/modifying the Exif values for "Credit" and "Digital Source Type" to New or literally anything or nothing (just empty), it removed the AI banner/tag that earlier used to say this photo was created using Generative AI and Modified with Clean Up!

When opened in Photos.app no "Modified with Clean Up" tag is seen!

Conclusion:
Apple does work in mysterious ways! Why?
When a photo is edited using Cleanup, the cleanup metadata is stored in the Exif data of the image and not the extended attributes!
This exif data can be modified to make it look like the image was not modified or generated using AI!
How to recognize if the Photo is not original and modified using Clean Up?
There are 2 ways for this:
Open photo in Photos.app and look out for the tag/banner associated with Clean Up by clicking on Info.
Provider: Apple Photos Clean UpDigital Source Type: Edited using Generative AICheck the Exif Data of the photo and look out for:
Credit : Apple Photos Clean Up
Digital Source Type : http://cv.iptc.org/newscodes/digitalsourcetype/compositeWithTrainedAlgorithmicMediac. Check the extended attributes of the photos and look out for com.apple.quarantine which will say Photos as Cleanup is available within Photos.app
com.apple.quarantine:
00000000Â 30 30 38 32 3B 36 37 62 31 66 61 61 63 3B 50 68Â |0082;67b1faac;|
00000010Â 6F 74 6F 73 3B Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â |Photos;|
00000015
How can you fool someone using just Exif data manipulation?
Make them believe, deceive the users by editing the "Image modified by Cleanup" tag/banner!
Edit Both the Exif data values
Credit
Digital Source Type




