Apple Intelligence Photo Forensics: Photo Cleanup
- mrbhargavrathod
- Feb 16
- 18 min read
Updated: Mar 18

Uncover how Apple's new Apple Intelligence/AI tools are setting a new standard in photo editing and forensic analysis!
Background:
I was just playing around with Apple's Image Playground and Photo Cleanup. Curiosity got the best of me, and I ended up writing this blog post of my experimental stuff on Apple Intelligence Photo Forensics!
I clicked a photo with my iPhone while I was travelling to Bangkok (Refer to Fig 1 below). This is one of the famous spots/tourist attractions for food lovers in Bangkok :)

Original Image analysis:
Extended attributes analysis:
As this photo was captured on an iPhone and later on dropped to the macOS via Airdrop, we see a bunch of extended attributes (xattr) added to the file by macOS. Refer to A1.1 below
The important extended attributes are:
com.apple.assetsd.importedByDisplayName:
00000000 43 61 6D 65 72 61 |Camera|
00000006
com.apple.assetsd.creatorBundleID:
00000000 63 6F 6D 2E 61 70 70 6C 65 2E 63 61 6D 65 72 61 00000010 |com.apple.camera|
Exif data analysis:
When the photo was captured, the location data was enabled hence it captured all those location details and stored it in the Exif data of the photo. Refer to A1.2 below
The Exif data of interest to us are given below and they signify that the photo was clicked on an iPhone. I have not included that Location metadata as it may be turned on or off by the user's preference.
Host Computer : iPhone 16
Lens Make : Apple
Lens Model : iPhone 16 back dual wide camera 5.96mm f/1.6
Lens ID : iPhone 16 back dual wide camera 5.96mm f/1.6
Extended attributes and Exif data of the originally captured photo:
A1.1 - Original Photo extended attributes
com.apple.assetsd.UUID:
00000000 73 65 42 3A 82 CE 45 3B 9A 13 F2 0D 04 C5 8F 0A |seB:..E;........|
00000010
com.apple.assetsd.addedDate:
00000000 62 70 6C 69 73 74 30 30 33 41 C6 73 B2 EC C4 80 |bplist003A.s....|
00000010 D0 08 00 00 00 00 00 00 01 01 00 00 00 00 00 00 |................|
00000020 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000030 00 11 |..|
00000032
com.apple.assetsd.assetType:
00000000 03 00 |..|
00000002
com.apple.assetsd.avalanche.type:
00000000 00 00 |..|
00000002
com.apple.assetsd.cloudAsset.UUID:
00000000 37 33 36 35 34 32 33 41 2D 38 32 43 45 2D 34 35 |7XXXXXXX-82CE-45|
00000010 33 42 2D 39 41 31 33 2D 46 32 30 44 30 34 43 35 |3B-XXXX-FXXXXX5|
00000020 38 46 30 41 |8F0A|
00000024
com.apple.assetsd.creatorBundleID:
00000000 63 6F 6D 2E 61 70 70 6C 65 2E 63 61 6D 65 72 61 |com.apple.camera|
00000010
com.apple.assetsd.currentSleetCast:
00000000 01 00 |..|
00000002
com.apple.assetsd.customCreationDate:
00000000 62 70 6C 69 73 74 30 30 33 41 C6 73 B2 EC A0 20 |bplist003A.s... |
00000010 C5 08 00 00 00 00 00 00 01 01 00 00 00 00 00 00 |................|
00000020 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000030 00 11 |..|
00000032
com.apple.assetsd.customLocation:
00000000 29 8E 16 7A D7 83 2B 40 FA 34 14 64 F1 1F 59 40 |)..z..+@.4.d..Y@|
00000010 71 5E 1E FE D6 81 1B 40 00 6F 4C 9F D1 DD 35 40 |q^.....@.oL...5@|
00000020 00 00 00 00 00 00 00 00 04 76 EA DF 72 70 74 40 |.........v..rpt@|
00000030 00 00 00 00 00 00 00 00 00 00 00 EC B2 73 C6 41 |.............s.A|
00000040
com.apple.assetsd.dbRebuildUuid:
00000000 36 34 34 37 45 37 36 37 2D 30 35 36 36 2D 34 33 |6447E767-0566-43|
00000010 37 33 2D 42 30 31 32 2D 38 32 46 33 43 31 31 38 |73-B012-82F3C118|
00000020 43 30 39 41 |C09A|
00000024
com.apple.assetsd.deferredProcessing:
00000000 00 00 |..|
00000002
com.apple.assetsd.favorite:
00000000 00 00 |..|
00000002
com.apple.assetsd.hidden:
00000000 00 00 |..|
00000002
com.apple.assetsd.importedBy:
00000000 01 00 |..|
00000002
com.apple.assetsd.importedByDisplayName:
00000000 43 61 6D 65 72 61 |Camera|
00000006
com.apple.assetsd.libraryScopeAssetContributorsToUpdate:
00000000 62 70 6C 69 73 74 30 30 D4 01 02 03 04 05 06 07 |bplist00........|
00000010 0A 58 24 76 65 72 73 69 6F 6E 59 24 61 72 63 68 |.X$versionY$arch|
00000020 69 76 65 72 54 24 74 6F 70 58 24 6F 62 6A 65 63 |iverT$topX$objec|
00000030 74 73 12 00 01 86 A0 5F 10 0F 4E 53 4B 65 79 65 |ts....._..NSKeye|
00000040 64 41 72 63 68 69 76 65 72 D1 08 09 54 72 6F 6F |dArchiver...Troo|
00000050 74 80 00 A1 0B 55 24 6E 75 6C 6C 08 11 1A 24 29 |t....U$null...$)|
00000060 32 37 49 4C 51 53 55 00 00 00 00 00 00 01 01 00 |27ILQSU.........|
00000070 00 00 00 00 00 00 0C 00 00 00 00 00 00 00 00 00 |................|
00000080 00 00 00 00 00 00 5B |......[|
00000087
com.apple.assetsd.libraryScopeShareState:
00000000 00 00 00 00 00 00 00 00 |........|
00000008
com.apple.assetsd.originalFilename:
00000000 49 4D 47 5F 30 30 31 32 2E 48 45 49 43 |IMG_0012.HEIC|
0000000D
com.apple.assetsd.sceneAnalysisIsFromPreivew:
00000000 00 00 |..|
00000002
com.apple.assetsd.syndicationHistory:
00000000 00 00 |..|
00000002
com.apple.assetsd.timeZoneName:
00000000 47 4D 54 2B 30 37 30 30 |GMT+0700|
00000008
com.apple.assetsd.timeZoneOffset:
00000000 70 62 00 00 |pb..|
00000004
com.apple.assetsd.trashed:
00000000 00 00 |..|
00000002
com.apple.assetsd.trashedReason:
00000000 00 00 |..|
00000002
com.apple.assetsd.videoComplementVisibility:
00000000 00 00 |..|
00000002
com.apple.assetsd.viewPresentation:
00000000 00 00 |..|
00000002
com.apple.lastuseddate#PS:
00000000 2D 40 A7 67 00 00 00 00 FD C2 19 36 00 00 00 00 |-@.g.......6....|
00000010
com.apple.quarantine:
00000000 30 30 38 31 3B 36 37 61 37 34 30 32 64 3B 73 68 |0081;67a7402d;sh|
00000010 61 72 69 6E 67 64 3B 34 33 36 33 37 37 39 33 2D |aringd;XXXX793-|
00000020 42 38 34 32 2D 34 34 42 38 2D 39 37 33 45 2D 46 |B842-44B8-973E-F|
00000030 41 45 44 31 35 30 43 41 34 32 30 |AED150CA420|
0000003B
A1.2 - Original Photo Exif data
ExifTool Version Number : 13.18
File Name : IMG_0012.HEIC
Directory : /Users/*/Downloads
File Size : 3.0 MB
File Modification Date/Time : 2024:11:15 16:49:53+05:30
File Access Date/Time : 2025:02:09 13:40:37+05:30
File Inode Change Date/Time : 2025:02:08 16:59:49+05:30
File Permissions : -rw-r--r--
File Type : HEIC
File Type Extension : heic
MIME Type : image/heic
Major Brand : High Efficiency Image Format HEVC still image (.HEIC)
Minor Version : 0.0.0
Compatible Brands : mif1, MiHB, MiHA, heix, MiHE, MiPr, miaf, heic, tmap
Handler Type : Picture
Primary Item Reference : 46
Meta Image Size : 5712x4284 0 1287 4096 3072 0 516 2856 2142 0 0 64 0 0 15 16960 26 37275 15 16960 65533 56960 15 16960 26 37275 15 16960 11 53518 15 16960 0 10 15 16960 0 10 15 16960
XMP Toolkit : XMP Core 6.0.0
Auxiliary Image Sub Type : portraiteffectsmatte
Native Format : L008
Stored Format : L008
Portrait Effects Matte Version : 65537
Semantic Segmentation Matte Version: 65536
HDR Gain Map Version : 0.2.0.0
HDR Gain Map Headroom : 3.343157
Exif Byte Order : Big-endian (Motorola, MM)
Make : Apple
Camera Model Name : iPhone 16
Orientation : Rotate 90 CW
X Resolution : 72
Y Resolution : 72
Resolution Unit : inches
Software : 18.0.1
Modify Date : 2024:11:15 18:19:53
Host Computer : iPhone 16
Exposure Time : 1/25
F Number : 1.6
Exposure Program : Program AE
ISO : 500
Exif Version : 0232
Date/Time Original : 2024:11:15 18:19:53
Create Date : 2024:11:15 18:19:53
Offset Time : +07:00
Offset Time Original : +07:00
Offset Time Digitized : +07:00
Shutter Speed Value : 1/25
Aperture Value : 1.6
Brightness Value : -1.124403185
Exposure Compensation : 0
Metering Mode : Multi-segment
Flash : Off, Did not fire
Focal Length : 6.0 mm
Subject Area : 2836 2129 3277 1875
Maker Note Version : 15
Run Time Flags : Valid
Run Time Value : 2629324449166
Run Time Scale : 1000000000
Run Time Epoch : 0
AE Stable : Yes
AE Target : 135
AE Average : 130
AF Stable : Yes
Acceleration Vector : 0.009677661592 -1.005830288 0.03582436219
Focus Distance Range : 0.46 - 0.46 m
Image Capture Type : Scene
Live Photo Video Index : 8595185700
Photos App Feature Flags : 0
HDR Headroom : 1.00999999
AF Performance : 268 1 21
Signal To Noise Ratio : 29.13035585
Photo Identifier : B4B41692-F2AD-436C-8F34-6DB794D3E1F7
Color Temperature : 3696
Camera Type : Back Normal
Focus Position : 54
HDR Gain : 1.854003906
Sub Sec Time Original : 251
Sub Sec Time Digitized : 251
Color Space : Uncalibrated
Exif Image Width : 5712
Exif Image Height : 4284
Sensing Method : One-chip color area
Scene Type : Directly photographed
Exposure Mode : Auto
White Balance : Auto
Digital Zoom Ratio : 1.182771949
Focal Length In 35mm Format : 43 mm
Lens Info : 2.220000029-5.960000038mm f/1.6-2.2
Lens Make : Apple
Lens Model : iPhone 16 back dual wide camera 5.96mm f/1.6
Composite Image : General Composite Image
GPS Latitude Ref : North
GPS Longitude Ref : East
GPS Altitude Ref : Above Sea Level
GPS Time Stamp : 11:19:52
GPS Speed Ref : km/h
GPS Speed : 0
GPS Img Direction Ref : True North
GPS Img Direction : 327.0280456
GPS Dest Bearing Ref : True North
GPS Dest Bearing : 327.0280456
GPS Date Stamp : 2024:11:15
GPS Horizontal Positioning Error: 21.86647983 m
Color Profiles : nclx
Image Width : 5712
Image Height : 4284
Image Spatial Extent : 5712x4284
Image Pixel Depth : 10 10 10
Red Matrix Column : 0.51512 0.2412 -0.00105
Green Matrix Column : 0.29198 0.69225 0.04189
Blue Matrix Column : 0.1571 0.06657 0.78407
Red Tone Reproduction Curve : (Binary data 32 bytes, use -b option to extract)
Blue Tone Reproduction Curve : (Binary data 32 bytes, use -b option to extract)
Green Tone Reproduction Curve : (Binary data 32 bytes, use -b option to extract)
Gray Tone Reproduction Curve : (Binary data 14 bytes, use -b option to extract)
Auxiliary Image Type : urn:com:apple:photo:2018:aux:portraiteffectsmatte
Profile CMM Type : Apple Computer Inc.
Profile Version : 4.0.0
Profile Class : Display Device Profile
Color Space Data : RGB
Profile Connection Space : XYZ
Profile Date Time : 2024:01:01 00:00:00
Profile File Signature : acsp
Primary Platform : Apple Computer Inc.
CMM Flags : Not Embedded, Independent
Device Manufacturer : Apple Computer Inc.
Device Model :
Device Attributes : Reflective, Glossy, Positive, Color
Rendering Intent : Perceptual
Connection Space Illuminant : 0.9642 1 0.82491
Profile Creator : Apple Computer Inc.
Profile ID : 27a72bb01aaadc03f504deef4c429688
Profile Description : Display P3 Primaries; PQ (Gain Map Preview B0C3CA6929011C3C)
Profile Copyright : Copyright Apple Inc., 2024
Media White Point : 0.96419 1 0.82489
A To B0 : (Binary data 6412 bytes, use -b option to extract)
B To A0 : (Binary data 6412 bytes, use -b option to extract)
Chromatic Adaptation : 1.04788 0.02292 -0.0502 0.02959 0.99048 -0.01706 -0.00923 0.01508 0.75168
Color Primaries : SMPTE EG 432-1
Transfer Characteristics : SMPTE ST 2084, ITU BT.2100 PQ
Matrix Coefficients : Identity matrix
Video Full Range Flag : Full
HD Gain Map Info : (Binary data 230 bytes, use -b option to extract)
Luminance : 0 100 0
Rotation : Horizontal (Normal)
HEVC Configuration Version : 1
General Profile Space : Conforming
General Tier Flag : Main Tier
General Profile IDC : Main Still Picture
Gen Profile Compatibility Flags : Main Still Picture, Main 10, Main
Constraint Indicator Flags : 176 0 0 0 0 0
General Level IDC : 63 (level 2.1)
Min Spatial Segmentation IDC : 0
Parallelism Type : 0
Chroma Format : 4:2:0
Bit Depth Luma : 8
Bit Depth Chroma : 8
Average Frame Rate : 0
Constant Frame Rate : Unknown
Num Temporal Layers : 1
Temporal ID Nested : No
Media Data Size : 3010356
Media Data Offset : 23551
Run Time Since Power Up : 0:43:49
Aperture : 1.6
Image Size : 5712x4284
Megapixels : 24.5
Scale Factor To 35 mm Equivalent: 7.2
Shutter Speed : 1/25
Create Date : 2024:11:15 18:19:53.251+07:00
Date/Time Original : 2024:11:15 18:19:53.251+07:00
Modify Date : 2024:11:15 18:19:53+07:00
GPS Altitude : 6.8 m Above Sea Level
GPS Date/Time : 2024:11:15 11:19:52Z
GPS Latitude : 13 deg 45' 27.01" N
GPS Longitude : 100 deg 29' 56.79" E
Circle Of Confusion : 0.004 mm
Field Of View : 45.4 deg
Focal Length : 6.0 mm (35 mm equivalent: 43.0 mm)
GPS Position : 13 deg 45' 27.01" N, 100 deg 29' 56.79" E
Hyperfocal Distance : 5.33 m
Light Value : 3.7
Lens ID : iPhone 16 back dual wide camera 5.96mm f/1.6
Modifying the image using Clean up feature in Photos.app:
I open this photo with the extended attributes and Exif data with Photos.app because the Photo Cleanup feature is available only inside Photos.app application in iOS and macOS.
Photo Clean Up process in Photos.app:
This section provides details on the steps involved in Photo Cleanup
Open the Photos.app and import the photo and click on Edit at the top right

Select Clean Up

Once you click the Clean Up,
If you have never visited the Clean Up module, you would need to click to download the Clean Up module which will just a few seconds as shown in the below image

Select the parts of the photo you would like to cleanup by zooming in and out.
The Clean Up module will automatically identify people from the photo and highlight them in pink which blinks. If you would like to remove it, just click on the pink blinking area.
Click save. You can either override the same image or create a new file.

After Clean Up the photo looks like this:
Fig 1.5 Photo preview after Cleanup
So, once you Clean Up the photo, the metadata and extended attributes of the photo changes!
Exif data analysis after using Clean Up:
It removed your location metadata along with your make and model data from the Exif data. Check A2.1
The Exif data of interest to us are given below and they signify that the photo
Credit : Apple Photos Clean Up
Digital Source Type : http://cv.iptc.org/newscodes/digitalsourcetype/compositeWithTrainedAlgorithmicMedia
These 2 are added to the Exif data after a photo is edited using Cleanup feature inside Photos.app.
Extended attribute analysis after using Clean Up:
Photos.app is added to the com.apple.quarantine attribute replacing the sharingd as it was dropped via Airdrop.
All the other exteded attributes are just flushed out! Check A2.2 below
Exif data and Extended attribites after using Clean Up via Photos.app:
A2.1 - Image Exif data after using Cleanup
ExifTool Version Number : 13.10
File Name : 161B0B91-D629-45C2-BD55-4A0F85767A81_1_201_a.heic
Directory : /Users/Downloads
File Size : 2.4 MB
File Modification Date/Time : 2025:02:08 17:35:30+05:30
File Access Date/Time : 2025:02:08 17:37:11+05:30
File Inode Change Date/Time : 2025:02:08 17:37:10+05:30
File Permissions : -rw-r--r--
File Type : HEIC
File Type Extension : heic
MIME Type : image/heic
Major Brand : High Efficiency Image Format HEVC still image (.HEIC)
Minor Version : 0.0.0
Compatible Brands : mif1, MiHE, miaf, MiHB, heic
Handler Type : Picture
Primary Item Reference : 31
Meta Image Size : 4284x5712 0 514 2142 2856
Exif Byte Order : Big-endian (Motorola, MM)
Orientation : Horizontal (normal)
XMP Toolkit : XMP Core 6.0.0
Credit : Apple Photos Clean Up
Digital Source Type : http://cv.iptc.org/newscodes/digitalsourcetype/compositeWithTrainedAlgorithmicMedia
HDR Gain Map Version : 0.2.0.0
HDR Gain Map Headroom : 3.343157
Profile CMM Type : Apple Computer Inc.
Profile Version : 4.0.0
Profile Class : Display Device Profile
Color Space Data : RGB
Profile Connection Space : XYZ
Profile Date Time : 2022:01:01 00:00:00
Profile File Signature : acsp
Primary Platform : Apple Computer Inc.
CMM Flags : Not Embedded, Independent
Device Manufacturer : Apple Computer Inc.
Device Model :
Device Attributes : Reflective, Glossy, Positive, Color
Rendering Intent : Perceptual
Connection Space Illuminant : 0.9642 1 0.82491
Profile Creator : Apple Computer Inc.
Profile ID : ecfda38e388547c36db4bd4f7ada182f
Profile Description : Display P3
Profile Copyright : Copyright Apple Inc., 2022
Media White Point : 0.96419 1 0.82489
Red Matrix Column : 0.51512 0.2412 -0.00105
Green Matrix Column : 0.29198 0.69225 0.04189
Blue Matrix Column : 0.1571 0.06657 0.78407
Red Tone Reproduction Curve : (Binary data 32 bytes, use -b option to extract)
Chromatic Adaptation : 1.04788 0.02292 -0.0502 0.02959 0.99048 -0.01706 -0.00923 0.01508 0.75168
Blue Tone Reproduction Curve : (Binary data 32 bytes, use -b option to extract)
Green Tone Reproduction Curve : (Binary data 32 bytes, use -b option to extract)
Max Content Light Level : 203
Max Pic Average Light Level : 64
Image Width : 4284
Image Height : 5712
Image Spatial Extent : 4284x5712
Rotation : Horizontal (Normal)
Image Pixel Depth : 8 8 8
Gray Tone Reproduction Curve : (Binary data 14 bytes, use -b option to extract)
Auxiliary Image Type : urn:com:apple:photo:2020:aux:hdrgainmap
HEVC Configuration Version : 1
General Profile Space : Conforming
General Tier Flag : Main Tier
General Profile IDC : Main Still Picture
Gen Profile Compatibility Flags : Main Still Picture, Main 10, Main
Constraint Indicator Flags : 176 0 0 0 0 0
General Level IDC : 93 (level 3.1)
Min Spatial Segmentation IDC : 0
Parallelism Type : 0
Chroma Format : 4:2:0
Bit Depth Luma : 8
Bit Depth Chroma : 8
Average Frame Rate : 0
Constant Frame Rate : Unknown
Num Temporal Layers : 1
Temporal ID Nested : No
Media Data Size : 2391354
Media Data Offset : 3653
Image Size : 4284x5712
Megapixels : 24.5
Analyzing the Exif data after Clean Up:
Digital Source Type : http://cv.iptc.org/newscodes/digitalsourcetype/compositeWithTrainedAlgorithmicMedia
Guess what happens when you open this URL!

When you open an image in Photos/Preview containing this Exif value, it is automatically parsed and shows you the tag "Modified with Clean Up" in Photos.app (both iOS and macOS) as shown in below Fig 2.1

When the same info is viewed using Preview.app as shows in Fig2.2, it shows a different output saying the below which is retreived and parsed from the "Digital Source Type" Exif data which was added after using Clean Up.
Provider: Apple Photos Clean Up
Digital Source Type: Edited using Generative AI

Manipulating Exif data for fun and deceiving!
We remove the 2 Exifdata values to check if the tag/banner is removed.
First we modifyedit the Credit Exif value to "New"
This is the command used for this:
exiftool -Credit="New" /Users/malware/Downloads/2DF49D93-4ED4-45D5-B6E6-3051B34076B1_1_102_a.jpeg
Unsuccesful Result:
Even after changing/modifying the "Credit" exif data it still showed that the photo was cleanup
Let's edit/modify the "Digital Source Type" Exif value to "New"
This is the command used for this:
exiftool -DigitalSourceType="New" /Users/Downloads/2DF49D93-4ED4-45D5-B6E6-3051B34076B1_1_102_a.jpeg
Success and Final Result:
Wohoo! So executing both the command and editing/modifying the Exif values for "Credit" and "Digital Source Type" to New or literally anything or nothing (just empty), it removed the AI banner/tag that earlier used to say this photo was created using Generative AI and Modified with Clean Up!

When opened in Photos.app no "Modified with Clean Up" tag is seen!

Conclusion:
Apple does work in mysterious ways! Why?
When a photo is edited using Cleanup, the cleanup metadata is stored in the Exif data of the image and not the extended attributes!
This exif data can be modified to make it look like the image was not modified or generated using AI!
How to recognize if the Photo is not original and modified using Clean Up?
There are 2 ways for this:
Open photo in Photos.app and look out for the tag/banner associated with Clean Up by clicking on Info.
Provider: Apple Photos Clean Up
Digital Source Type: Edited using Generative AI
Check the Exif Data of the photo and look out for:
Credit : Apple Photos Clean Up
Digital Source Type : http://cv.iptc.org/newscodes/digitalsourcetype/compositeWithTrainedAlgorithmicMedia
c. Check the extended attributes of the photos and look out for com.apple.quarantine which will say Photos as Cleanup is available within Photos.app
com.apple.quarantine:
00000000 30 30 38 32 3B 36 37 62 31 66 61 61 63 3B 50 68 |0082;67b1faac;|
00000010 6F 74 6F 73 3B |Photos;|
00000015
How can you fool someone using just Exif data manipulation?
Make them believe, deceive the users by editing the "Image modified by Cleanup" tag/banner!
Edit Both the Exif data values
Credit
Digital Source Type