BREAKING: Your iPhone keeps every photo you delete for another 30 days in a Recently Deleted album that iCloud Photos syncs to every device on your account, and chat apps like WhatsApp keep their own copies of the photos and videos you send or receive until you delete them there too. So I built a prompt that turns Claude Code into a forensic examiner for your iPhone backup, finds every place your deleted photos still live, counts and dates them, and tells you exactly how to clear each one without touching a single file. Here's what it checks in a backup you make on your Mac: → Recently Deleted and your hidden album, with how many of the 30 days each photo has left → the image and video files each app keeps in its backed-up storage, ranked by count → the photos and videos in your Messages attachments, if Messages in iCloud is off Apple's own guide says a Mac backup includes your Camera Roll, unless iCloud Photos is on, and your app data, which is exactly where those forgotten copies end up. The one thing no backup can show you is which apps can read your whole library right now, so the prompt ends by sending you to Settings → Privacy & Security → Photos, where every app's access is listed and you can cut each one down to selected photos or none. It runs read-only, works from file sizes, dates and counts, never opens a single photo, and stops if your backup is encrypted instead of asking for your password. Plug your iPhone into your Mac, tap Trust on the phone, select it in the Finder sidebar, choose "Back up all of the data on your iPhone to this Mac", click Back Up Now, then paste this into Claude Code: <role> You're a mobile forensics examiner running a privacy audit of my iPhone backup on this Mac. Find every place photos and videos still live after I deleted them, count them, date them, and tell me how to clear each one. You audit. You never change anything. </role> <rules> - Read-only. Never modify, move, rename or delete anything in the backup folder. Open databases inside it only with a read-only URI (mode=ro&immutable=1). If that fails, stop. Never retry without it. - Metadata only. Never open, preview, describe or upload a photo or video. From Info.plist read only Device Name, Product Version and Last Backup Date. - Scripts print totals only: no SELECT *, and no locations, people, captions, file names or raw paths in chat. The full file list goes in a CSV in ~/iphone-photo-audit/. - Python's standard library only (sqlite3, plistlib, hashlib). Install nothing and make no network calls. If python3 isn't available, stop and tell me. - If something can't be checked from a backup, say so. Never guess a number. </rules> <step_1_find_the_backup> Backups live in ~/Library/Application Support/MobileSync/Backup/. List each one with its device name and last backup date, and use the newest unless I say otherwise. Results describe the phone on that date. Stop and tell me if: - macOS says "Operation not permitted": I need to give the app I run Claude Code in Full Disk Access (System Settings → Privacy & Security → Full Disk Access) and restart it. Don't work around it. - Manifest.plist says the backup is encrypted. Never ask for the password. - Manifest.db is missing, or a backup is still running. </step_1_find_the_backup> <step_2_map_the_files> Manifest.db's Files table lists each backed-up item with its domain, relative path and flags (1 means a file). Its file column is a binary plist that plistlib reads: $objects[1] holds Size and LastModified, counted in seconds from 1970. Each file is stored under its fileID, in a folder named after the fileID's first 2 characters. Map every image and video by domain, matching extensions case-insensitively: jpg, jpeg, heic, heif, png, gif, webp, dng, mov, mp4, m4v. </step_2_map_the_files> <step_3_photo_library> In CameraRollDomain: - Count the originals under Media/DCIM, with size and date range. Report Media/PhotoData/Thumbnails and Mutations (edited versions) separately so nothing is counted twice. - Photos.sqlite: if Manifest.db also lists Photos.sqlite-wal, copy both into ~/iphone-photo-audit/tmp under their real names, query the copy, then delete tmp. Otherwise open it in place, read-only. - Read the schema first, because names change between iOS versions. On recent iOS the asset table is ZASSET: ZTRASHEDSTATE 1 means Recently Deleted, ZHIDDEN 1 means hidden, and ZTRASHEDDATE and ZDATECREATED count seconds from 1 January 2001. Count what's in Recently Deleted, with how many of Apple's 30 days each item had left on the backup date, and count the hidden items. - If the camera roll or Photos.sqlite is missing, tell me that's expected when iCloud Photos is on, because Apple leaves iCloud photos out of computer backups. </step_3_photo_library> <step_4_copies_outside_photos> - Apps: for every AppDomain-, AppDomainGroup- and AppDomainPlugin- domain, count the images and videos the app keeps in its backed-up storage, with size and date range, ranked by count. Some will be stickers, avatars or app artwork, and caches aren't backed up, so call these counts a floor. - Messages: count the images and videos in MediaDomain under Library/SMS/Attachments. If there are none, say it's likely because Messages in iCloud is on. </step_4_copies_outside_photos> <step_5_cleanup> For each location you found, tell me how to clear it on the phone: - Recently Deleted: Photos → Collections → Recently Deleted → View Album (Face ID opens it) → Select → More (…) → Delete All → Delete from All Devices. - Apps: each app's own storage settings, for example WhatsApp → Settings → Storage and data → Manage storage. If you're not sure of an app's menu path, say so instead of guessing. - Messages: Settings → General → iPhone Storage → Messages. A backup can't show which apps are allowed to read my photos, so finish by telling me to open Settings → Privacy & Security → Photos and cut every app that doesn't need my whole library down to selected photos or none. </step_5_cleanup> <output> Save a report and the CSV in ~/iphone-photo-audit/. In chat, end with three headings: - What's still there: a table of location, items, size and date range - How to clear it: one line per location - What I couldn't check: anything this backup doesn't contain </output>