iPhone metadata

Started by Charlie_t, July 22, 2022, 02:18:58 PM

Previous topic - Next topic

Charlie_t

Hi,
I would like to ask you how can I determine if the iPhone is genuine or fake from the metadata of its picture?
One way would be to take the serial number of the picture and compare it against coverage apple website, but there is no SN embedded in iPhone pictures.
Is there any indirect way to find out?

Thank you

Phil Harvey

You really can't tell if a photo is fake from the metadata if the editor knew what he was doing.

- Phil
...where DIR is the name of a directory/folder containing the images.  On Mac/Linux/PowerShell, use single quotes (') instead of double quotes (") around arguments containing a dollar sign ($).

Joanna Carter

How about comparing the content creation date to the modified date?

Charlie_t

No, my question was misunderstood. I would like to know, where in the metadata of the photo I can identify, that it comes from the iPhone?.. I mean if someone would have some fake iPhone vs. the real one. Some verification of the device.

Phil Harvey

There is no way to tell the difference by looking at the metadata.  ExifTool can be used to copy all metadata from a real iPhone photo to a fake one.

- Phil
...where DIR is the name of a directory/folder containing the images.  On Mac/Linux/PowerShell, use single quotes (') instead of double quotes (") around arguments containing a dollar sign ($).

Charlie_t

Well, there are still a lot of misunderstandings. When I buy an iPhone and take a picture, then I view its metadata in exiftool (no modification), which indications say that this photo comes from the genuine Apple product besides of the name of the model? I mean "profile creator: Apple Computer Inc."? Or "profile copyright: Copyright Apple Inc., 2017?"

greybeard

The point is that if someone creates a fake photo they could easily copy the metadata from a genuine iPhone to the fake - you couldn't then tell the photo was fake by looking at the metadata.

What are you trying to achieve?

Hubert

Quote from: Charlie_t on July 27, 2022, 11:29:52 AM
When I buy an iPhone and take a picture, then I view its metadata in exiftool (no modification), which indications say that this photo comes from the genuine Apple product besides of the name of the model? I mean "profile creator: Apple Computer Inc."? Or "profile copyright: Copyright Apple Inc., 2017?"

Try

exiftool /path/to/file/ -g1

This will break down the metadata into groups: you'll see that the two 'profile' tags are ICC colour profiles that don't have any direct relation to the device - anyone can add them, and neither of them can tell you whether or not the device is genuine.

I may be wrong about this, but here goes...

Assuming you have the device in your possession: you take a new picture with it, send it to your Mac or PC without modification, and run that command on it. What do you see?

What I see, with a photo directly saved out of my Apple iPhone 12 mini (bought from an Apple Authorised Reseller, so I'm certain beyond any reasonable doubt that it's genuine), is the following:


---- Apple ----
Run Time Flags                  : Valid
Run Time Value                  : 132798859874458
Run Time Scale                  : 1000000000
Run Time Epoch                  : 0
Acceleration Vector             : 0.05430822074 -0.9882273664 -0.149233073
---- GPS ----
...snip...


According to the ExifTool Apple tags page, the first four of those tags are not writable by ExifTool. So their presence in an image straight from the phone may be an indication that the device that created the image is genuine.

Because tbh I don't think anyone producing fake iPhones is going to go to the trouble of getting the camera to write those tags.

It's not an absolute guarantee, of course, but it may give you a bit more evidence either way.

Other tags that may help, again from my phone:

Lens Make                       : Apple
Lens Model                      : iPhone 12 mini front camera 2.71mm f/2.2
...snip...
Lens ID                         : iPhone 12 mini front camera 2.71mm f/2.2


But just to re-iterate, those ICC tags give no indication that the device is genuine or fake.

Cheers,

H


greybeard

Ah I see - I missed the point - the concern is that the iPhone is genuine not the photo.

Either way I would have thought someone creating fake iphones would clone the operating system and write image metadata that would appear genuine.

Phil Harvey

I missed the point too.  But the answer is the same, only it is software on the phone instead of some hacker that is responsible for generating the iPhone-like metadata.

- Phil
...where DIR is the name of a directory/folder containing the images.  On Mac/Linux/PowerShell, use single quotes (') instead of double quotes (") around arguments containing a dollar sign ($).

Charlie_t

Excellent answer, that's what I was looking for, thank you!
Also I'd like to know why there is year 2017 in "profile copyright" of Apple regardless of the model?

Phil Harvey

The ICC color profile used for the image is from 2017.

- Phil
...where DIR is the name of a directory/folder containing the images.  On Mac/Linux/PowerShell, use single quotes (') instead of double quotes (") around arguments containing a dollar sign ($).