This is a bit of a silly question that I just need confirmation with.
When retrieving exif information, such as the camera model, software history....etc.....does the exifttool just pull that information from the hex information stored in the image? Essentially, I want to see if an image was opened in another software. However, someone could easily remove that exif information showing it was opened in another software. In order for someone to remove that exif information would they have to remove the hex information showing the software used, or can they just alter the exif information independently of the hex information?
I don't know what you mean by hex information. You can use Exiftool or other metadata software to change any of the meta information in a file.
- Phil
By hex information I mean the htmldump file. What I want to know is if someone can edit the output of the exif information while keeping the htmldump file intact/not edited.
Ah. One can always use a hex editor to do that.
- Phil
Right but can someone generate fake/modified EXIF information while keeping the hex/html dump file intact?
I don't know what you mean by keeping the hex/html intact. The hex html dump is a hex representation of the EXIF information. Do you mean to edit the information while keeping the EXIF valid? Or while maintaining the same structure? Or while keeping the same byte positions for all of the information? The answer is yes to all of these.
This answered my question" "Do you mean to edit the information while keeping the EXIF valid". Essentially the EXIF information is derived from from the hex/html dump file, correct?. BUT i did not know if someone can just edit the EXIF with out editing the htmldump/hex information.
Quote from: AL10 on January 25, 2019, 07:13:51 PM
Essentially the EXIF information is derived from from the hex/html dump file, correct?.
No, incorrect. The exif informatoon is not "derived" from the hex data. the exif information
IS the hex data in another format.