ExifTool Forum

Hello,
I am very new at using ExifTool and need help with some metadata recovery. I have a JPG file that was provided to me that was reportedly forged using Adobe Photoshop. Along with the JPG file, I was also given a copy of Exif Metadata and a separate copy of XMP Metadata, both of which supposedly came from the JPG file. I am trying to confirm that both sets of metadata came from the JPG file. Running the exiftool on a command prompt produces the exif metadata but despite trying different switches, I have not be able to produce the xmp metadata. I am hoping someone can provide some guidance on how to do that. Thanks in advance.

Jim

This is FAQ #3 (https://exiftool.org/faq.html#Q3).  Use that command and any XMP data will list the exact XMP group it belongs to, if it exists.

But for the most part, XMP isn't included in photos directly from the camera.  There are a few exceptions, such as cameras that save face regions.

One thing you can look at which isn't normally listed with the FAQ #3 command is the JPEGDigest tag.
exiftool -JPEGDigest file.jpg

How a jpeg is saved gives it a sort of fingerprint, which can indicate what program or code was used to save it.  From the notes for this tag on the Extra Tags page (https://exiftool.org/TagNames/Extra.html), it's defined as

Quotean MD5 digest of the JPEG quantization tables is combined with the component sub-sampling values to generate the value of this tag. The result is compared to known values in an attempt to deduce the originating software based only on the JPEG image data

Thanks for the info.