How to tell which app added a photo to my iCloud Photo Library

Today I noticed some photos in my iCloud Photo Library which I did not put there. I'm not talking about any shared album, this is my personal library. This is alarming since I have never shared my iCloud account or password with anyone, and I use Two-factor authentication for security.

I captured a sysdiagnose log and searched it like this for one of the filenames, but this reveals nothing.

log show --archive system_logs.logarchive --debug --predicate 'eventMessage contains[cd] IMG_8313"'

So how can I tell which application created a particular photo?

Solution 1:

I've figured it out after some investigation. Since some apps don't write anything to the log, we have to search the Photos database. The metadata exists here just as I suspected, in a column called ZCREATORBUNDLEID. To find it, first you need to install the "iCloud Photos for iOS" profile to enable diagnostics from here:
https://developer.apple.com/bug-reporting/profiles-and-logs/

Then trigger the diagnostic in Settings > Photos > Run Photos Diagnostics. Airdrop this file to your computer, untar it, and find the database inside called Photos.sqlite. Search like this

sqlite3 Photos.sqlite "SELECT ZCREATORBUNDLEID FROM ZADDITIONALASSETATTRIBUTES WHERE ZORIGINALFILENAME = 'IMG_8313.JPG';"
ZCREATORBUNDLEID = com.ifttt.ifttt

In this case, it turns out the photo came from an IFTTT applet that I had forgotten about.

Note: This metadata is available only in the iOS database, not in the macOS Photos database.