Differences betweeen Image size tags

[11august]

Hello!

For forensics purpose, I have to compare the metadata of two photos that show the same scenery. I strongly suspect that both are not genuine and that, at some point, some manipulation were done.

Besides some specific points that clearly show that something is wrong, I would like to know more about the creation/modification of the image size tags, as it could add points to the forgery suspicion pile.

On the first photo you have three groups of tags that say:

Exif Image Width : 1024
Exif Image Height: 768

Image Width: 928
Image Height: 768

Image Size: 928x768

On the second photo you have:

Image Width: 2959
Image Height: 2442

Image Size: 2959x2442

One classic thing I use to check at first is the Lxl image ratio which is usually either 1, 1,33, 1,5 or 1,77. Any other "odd" ratio strongly indicates that the photo was likely cropped.

Applied to the above, we respectively have 1,33; 1,21 for the first photo and 1,21 for the second photo, so I naturally tend to think that the only "genuine" tags are "Exif Image Width : 1024" and "Exif Image Height: 768" for the first photo.

Now my questions are:

1- why the difference between the tags "Exif Image Width/Exif Image Height" and "Image Width" and/or "Image Size" tags?
2- how are these tags produced?
3- could it be interpreted as a clue that the first image was vertically cropped from 1024 to 968?

Thanks!

[Phil Harvey]

Use the -G option to see where these tags come from.  The EXIF and MakerNotes image sizes are metadata written by the camera or some software and don't actually represent the size of the image.  The File sizes represent the actual size of the JPEG image.  Typically, when the image is created orginally, these should all agree, but after editing some editors don't update the metadata properly.

- Phil

[StarGeek]

I've found that the ExifImageHight/Width tags are rarely updated by most software. So obviously, that first image has been cropped at some point.

Also, if you are using exiftool to check the aspect ratio and doing the math manually, there's a config file that will compute the aspect ratio for you.  Though it doesn't do so for the ExifImageHight/Width, that would be easy enough to add.