How to tell which app added a photo to my iCloud Photo Library Today I noticed some photos in my iCloud Photo Library which I did not put there.  I'm not talking about any shared album, this is my personal library. This is alarming since I have never shared my iCloud account or password with anyone, and I use Two-factor authentication for security.

I captured a sysdiagnose log and searched it like this for one of the filenames, but this reveals nothing.

log show --archive system_logs.logarchive --debug --predicate 'eventMessage contains[cd] IMG_8313"'


So how can I tell which application created a particular photo?
I've figured it out after some investigation.  Since some apps don't write anything to the log, we have to search the Photos database.  The metadata exists here just as I suspected, in a column called ZCREATORBUNDLEID.  To find it, first you need to install the "iCloud Photos for iOS" profile to enable diagnostics from here:
https://developer.apple.com/bug-reporting/profiles-and-logs/

Then trigger the diagnostic in Settings > Photos > Run Photos Diagnostics.  Airdrop this file to your computer, untar it, and find the database inside called Photos.sqlite.  Search like this

sqlite3 Photos.sqlite "SELECT ZCREATORBUNDLEID FROM ZADDITIONALASSETATTRIBUTES WHERE ZORIGINALFILENAME = 'IMG_8313.JPG';"
ZCREATORBUNDLEID = com.ifttt.ifttt


In this case, it turns out the photo came from an IFTTT applet that I had forgotten about.

Note: This metadata is available only in the iOS database, not in the macOS Photos database.