一名用户借助 AI 编程工具 Claude Code 对 iPhone 执行安全审计时，在系统深处发现了大量本应“永久删除”的数据。该用户指出，共有 145,763 个文件——包括照片、视频和截图——仍留存于名为 PhotoData/Thumbnails 的隐藏目录中 1。这些数据的积累时间跨度从 2021 年延续至 2025 年，即便用户已经清空了 iOS 系统的“最近删除”文件夹，相关副本依然未被移除 1。
经分析，这一现象源于 iOS 为支持 Spotlight 搜索索引而保留压缩副本的机制，且苹果公司从未自动清除该缓存 1。这种设计导致任何拥有文件访问权限的应用均可读取这些敏感信息，其中包含护照照片、显示完整账号的银行应用截图、加密货币种子短语以及身份证件等高风险内容 1。鉴于此，作者呼吁用户立即检查并限制应用的隐私权限，建议将拥有“文件和文件夹”访问权的应用数量从原本的 23 个大幅缩减至仅 3 个，以降低数据泄露风险 1
A user discovered that 145,763 photos, videos, and screenshots marked as permanently deleted remained accessible on their iPhone within a hidden directory known as PhotoData/Thumbnails 1. The finding occurred during a security audit conducted using the AI coding tool Claude Code, which revealed that data spanning from 2021 to 2025 persisted even after being removed from the "Recently Deleted" folder 1. Apple retains compressed copies of this media for Spotlight search indexing but has never implemented an automatic clearing mechanism for this cache 1.
The persistence of these files poses significant privacy risks, as sensitive content such as passport images, bank application screenshots containing full account numbers, cryptocurrency seed phrases, and identification documents were found among the undeleted items 1. Any application with granted access to "Files and Folders" could potentially read this exposed data; the user had authorized 23 applications with such permissions prior to the audit 1. To mitigate this vulnerability, the article recommends reducing the number of apps with file system access from 23 to just 3, urging users to inspect and restrict permissions to prevent unauthorized exposure of supposedly deleted information 1.
评论
还没有评论，欢迎留下第一条。