Can photo timestamps and metadata be altered, and how can I check them?

Question

I received JPEGs by email and want to assess whether their capture date is trustworthy. The visible metadata fields like “date taken,” “date modified,” and sequential filenames appear consistent, but I know these can potentially be changed. Are there other metadata fields worth checking, such as GPS date/time or camera-specific tags? Also, is it normal for “date taken” and “date modified” to differ by a few seconds, or would that suggest editing? What tools or checks are useful if I want to inspect all available metadata and look for inconsistencies?

metadata gps exif timestamps forensics

Originally by Photography Stack Exchange contributor. Source · Licensed CC BY-SA 4.0

Photography Stack Exchange contributor

3y ago

user75947 · Answer

Not an expert in iPhone EXIF data, but a few things to check:

GPS time and other attributes

In my camera, if the picture has GPS coordinates, it also has a GPS time stamp (than can differ slightly from the other EXIF timestamps, if the camera isn't kept on GPS time). In fact it has a many GPS tags:

GPS Latitude Ref                : North
GPS Longitude Ref               : East
GPS Altitude Ref                : Above Sea Level
GPS Time Stamp                  : 19:02:26
GPS Processing Method           : GPS
GPS Date Stamp                  : 2019:08:19
GPS Altitude                    : 304.7 m Above Sea Level
GPS Date/Time                   : 2019:08:19 19:02:26Z
GPS Latitude                    : 48 deg 8' 23.60" N
GPS Longitude                   : 7 deg 15' 37.54" E
GPS Position                    : 48 deg 8' 23.60" N, 7 deg 15' 37.54" E

These tags are often ripped out by phone apps when transmitting the file. If you only have a couple of position tags, this could mean they have been added later. You can also find an iPhone 12 and find what GP tags it actually produces.

Camera serial number

In pictures from my old Motorola, there is a Serial number (which alone could help tracking its sell date/manufacture date) and even a Manufacture date. So these could indicate a camera more recent than the pictures...

Software version

Pictures from my more recent Android phone carry a Software tag that identifies the OS release in my camera (but it could be the camera app in other phones). Since smartphones receive automatic updates, even old phones would have a recent software version, and this pushes forward the earliest time a picture could have been taken by the camera (if it was overlooked by people altering EXIF data, of course). This will even define a time bracket (the picture must have been taken between the update that installed that version and the update that installed the next). In my smartphone, I have 4 different software releases for 2019 alone...