ExifTool Forum

ExifTool => The "exiftool" Application => Topic started by: mcquiff on April 10, 2018, 04:42:42 AM

Title: Computer Identifier
Post by: mcquiff on April 10, 2018, 04:42:42 AM
When a file is edited in photoshop is there anything in the exif information that relates to the computer it was edited in?

I can have the computer that is editing the file add that specific information but I want to avoid that if possible.

Matt
Title: Re: Computer Identifier
Post by: Phil Harvey on April 10, 2018, 08:05:13 AM
Hi Matt,

I don't know of any information that Photoshop adds which could be used to identify the computer, other than the software version number which is something like "Adobe Photoshop CS4 Macintosh".  It is possible that some information is encrypted in the document ID, but that would be sinister.

- Phil
Title: Re: Computer Identifier
Post by: mcquiff on April 11, 2018, 09:54:49 AM
Within the document ID it shows

adobe:docid:photoshop:ba24dc45-a9b0-ce4d-ac14-d7293b9fc2fa
adobe:docid:photoshop:f35c7f08-0da7-924a-9910-e534ecb99704

these are from 2 files  created on the same computer there is nothing in common between them. I presume thats a know then? Or should the info or code mean something else?
Title: Re: Computer Identifier
Post by: Phil Harvey on April 11, 2018, 10:00:00 AM
I have no idea what is used to generate the document ID.  If I were Adobe, I would use a hash of the Photoshop serial number with some other time-sensitive data.  If done like this, the serial number could potentially be recovered if the hash algorithm and the time-sensitive data were known.

- Phil
Title: Re: Computer Identifier
Post by: mcquiff on April 11, 2018, 11:22:48 AM
I found this https://www.hackerfactor.com/blog/index.php?/archives/552-Deep-Dive.html (https://www.hackerfactor.com/blog/index.php?/archives/552-Deep-Dive.html) but still nothing more, they talk of it containing the MAC address but I can't see that in mine.
Title: Re: Computer Identifier
Post by: Phil Harvey on April 11, 2018, 11:27:12 AM
Ha.  Interesting.  Good reference.  I was just shooting in the dark with the document ID idea, but it turns out that this may be true (in some cases).

And remember that just because you can't see it, that doesn't mean it isn't there.  As I said, it may be hashed or obfuscated so it isn't easily recognizable.

- Phil