ExifTool Forum

ExifTool => Newbies => Topic started by: AL10 on January 03, 2019, 11:51:06 PM

Title: Proof of tampered image/metadata
Post by: AL10 on January 03, 2019, 11:51:06 PM
I've received an image from a Hasselblad H4D-40 camera. I ran the exiftool to see if I can identify if this image was opened in any software to help me identify if this is an original captured raw file. I see there are a few warnings mentioned but I'm not sure what they stand for. Any help with that would be much appreciated.

Other then that, the data returned from the exiftool does not show any signs that this image was tampered with. I am running a variety of other forensic tests and not only relying on this tool but regarding the metadata, I was curious to see if anyone else sees anything suspicious. I've worked mainly with Canon and Nikon cameras but this is the first time I come across a camera like this so I was hoping for some extra feedback.

I've attached the what the exiftool returned to this message. I changed the directory as it showed personal information.
Title: Re: Proof of tampered image/metadata
Post by: Phil Harvey on January 04, 2019, 07:01:03 AM
The way to tell is to compare with an original file from the camera if you can get one.  I don't have a sample myself so I can't comment on what the camera writes originally.

- Phil