Fake fabricate JPEG date created

andwan0 · Mar 7, 2009

I am wanting some advice from jpeg photo experts. I know that taking a photograph, the date-taken is stored in the exif embedded in the jpeg. If one wanted to fabricate/fake the date-taken then he would need to copy the file to PC, use an editor to change it. The thing is you cannot change & keep the original file. It has to be saved as a NEW jpeg file because the exif metadata is embedded with the image (hence a 2nd recompression (& larger file size).

Now, that you know about exif metadata and it can be changed, is there any way in court by law on how to tell whether a jpeg file exif metadata has been faked? The file could easily be copied back onto the camera memory.

I guess the only way is to compare the file sizes of similar photo settings to the faked photo file.... to REAL photos taken by the camera (that are still stored in memory).

Anyway other ideas or technical know-how?

dl4449 · Mar 7, 2009

Why ??

leighthal · Mar 7, 2009

ditto.....why would this ever be necessary? The only reason that comes to mind is nefarious ones.

CW Jones · Mar 7, 2009

I feel like something illegal is going on..... why would it matter if a court could tell if the metadata was fake? I hardly believe anyone on here will bite and help in illegal activity....

MikeBcos · Mar 7, 2009

You can do whatever you like to the Exif data, the original file creation date is written into the file system, the Exif data is just a more readable addition to that data. You can edit and save as a copy as many times as you like, the creation date of the original file, last edited date (and that includes editing the Exif data) and last access date are embedded wthin the file itself and cannot be altered.

Josh66 · Mar 7, 2009

There is a system out there that will hold up in court but I can't remember what it's called or who makes it.
(All I can remember is that it's very expensive.)

If you're trying to fake some exif for a case you're involved in somehow, I wouldn't do it.

mrodgers · Mar 7, 2009

Why is everyone jumping on this as if the OP is doing something illegal? Perhaps he is asking because he is on the opposite side of the illegal and is trying to figure out if someone else could have done the illegal to him.

Jumping to conclusions before having the story here.....

beni_hung · Mar 7, 2009

Giving the benefit of the doubt is good, but even if he is looking for info to defend himself then the defense lawyer should be able to ask a local professional that could show up and hold up in court. Like a college professor for instance.

CW Jones · Mar 8, 2009

mrodgers said:
Why is everyone jumping on this as if the OP is doing something illegal? Perhaps he is asking because he is on the opposite side of the illegal and is trying to figure out if someone else could have done the illegal to him.

Jumping to conclusions before having the story here.....

first post on a forum is asking how to alter data?? If he comes back and explains WHY the data needs to be altered.... then I will take my conclusion back... until then its sketchy and seems very illegal.

EDIT:
after re-reading it a few times... he doesn't seem to be asking HOW to do it but more is there a way to tell.... I hope the OP comes back and spreads some more light on the situation....

andwan0 · Mar 8, 2009

Thanks, yes, found Exifer for Windows & PhotoME - Exif, IPTC & ICC Metadata Editor & AmoK Exif Sorter 2.52 (Official Website) & ExifTool by Phil Harvey (all recommended by EXIF guru Friedemann Schmidt). Found that the date created in EXIF can be modified solely, leaving the rest of the binary data intact, unaltered.

I am the defendant. The claimant submitted a document with 1 picture... to accuse about a time/date of an event from the picture alone. I was curious whether we can request for the original jpeg file and get professional experts to retrieve the date from the EXIF. Then I find out that the EXIF date can easily be modified. I just wanted to experiement and try to find anyway to know if the EXIF has been modified. From my experiement, there's no way knowing.....

Garbz · Mar 8, 2009

Not knowing where you are or what you are doing, but I can tell you a JPEG will not hold up in a court here in Australia, unless it was like a photo of a person standing next to a clock or something. EXIF data and even timestamps are easily modified.

There are systems in place to take photos of documents with proof including features on Nikon D200s and up which fingerprint the original RAW file so it can be seen if it has been altered in any way since it was taken with the camera.

Philarp · Oct 9, 2012

Hi Everyone!

I'm bringing this thread back to life as the issue of modifying EXIF data is becoming an common problem in my job. I work in insurance fraud investigations... we come accross claims where a person has suffered a genuine burglary, however when we compare the list of items they tell us have been stolen and compare it with what they advised police there is a lot more on there. So we ask for images of the stolen items. Quite often they provide images and we can quite easily tell they have taken said images AFTER the loss occured.

More and more people now realise it is quite simple to download something like "EXIF Date Changer" - this is obviously an issue for us. The post I quoted mentioned there are now systems in place that allow you to determeing if data has been altered in any way. Does anyone know what systems these are? I've spent half my morning trying to find something but have no idea.

Thanks in advance if anyone replies

Garbz said:
Not knowing where you are or what you are doing, but I can tell you a JPEG will not hold up in a court here in Australia, unless it was like a photo of a person standing next to a clock or something. EXIF data and even timestamps are easily modified.

There are systems in place to take photos of documents with proof including features on Nikon D200s and up which fingerprint the original RAW file so it can be seen if it has been altered in any way since it was taken with the camera.

480sparky · Oct 9, 2012

O|||||||O said:
There is a system out there that will hold up in court but I can't remember what it's called or who makes it.
(All I can remember is that it's very expensive.)

If you're trying to fake some exif for a case you're involved in somehow, I wouldn't do it.

Nikon used to offer Image Authentication Software, but it worked only for certain Nikon cameras. Since it got hacked a few years back, they've pulled it off the market.

But for a while, it was admissible in US courts.

snowbear · Oct 9, 2012

Here, in The States, a number of police departments have implemented their own computer forensic units. Some of these may also be knowledgeable about image files. Perhaps contacting a few of the larger departments might give you some insight.

Philarp · Oct 9, 2012

I can utilise the services of a forensic consultant who specialises in this field, however it's something like AU$880 for a comment. Unless I'm pretty sure that I'm looking at a fake, I dont really want to spend the $880. Suppose I'll just have to hope people are standing next to big old grandfather clocks when they take the images