Help needed uncovering more information about video data

Started by vscav12345, December 15, 2020, 12:06:54 PM

Previous topic - Next topic

vscav12345

I have a video that I am trying to get more information about. I believe this video to have been shot on November 10th 2019, but the person in the video claims that the video was made roughly 4 years ago and only just SENT on that November 10th 2019 date by the other party. The file name includes November 10th/11th 2019 (I'm confused why both dates appear in the metadata). I have the EXIF data here below. Based on this information here (resolution etc) what do you believe to be true? Also, I see the date on this data as saying November 11th 2019, but is it possible that it was filmed on a camera in 2016 roughly, possibly edited, then uploaded to a computer and sent to recipients phone. In this case would the file name  change when sent to the recipients phone? Also, regarding the quality of the video, the other party says it was shot on a high quality camera and possibly uploaded and then sent to their phone. I also noticed Track1:HandlerDescription   ISO Media file produced by Google Inc. Does this refer to the producer of the video or the recipient. Please help. This is very important to me.

System:FileName   VID_20191110_214647.mp4
System:FileSize   4581286
System:FileModifyDate   2020:12:15 16:24:17+00:00
System:FileAccessDate   2020:12:15 16:24:17+00:00
System:FileInodeChangeDate   2020:12:15 16:24:17+00:00
System:FilePermissions   644
File:FileType   MP4
File:FileTypeExtension   MP4
File:MIMEType   video/mp4
QuickTime:MajorBrand   mp42
QuickTime:MinorVersion   0.0.0
QuickTime:CompatibleBrands   [object Object]
QuickTime:MovieHeaderVersion   0
QuickTime:CreateDate   0000:00:00 00:00:00
QuickTime:ModifyDate   0000:00:00 00:00:00
QuickTime:TimeScale   1000
QuickTime:Duration   73.445
QuickTime:PreferredRate   1
QuickTime:PreferredVolume   1
QuickTime:MatrixStructure   1 0 0 0 1 0 0 0 1
QuickTime:PreviewTime   0
QuickTime:PreviewDuration   0
QuickTime:PosterTime   0
QuickTime:SelectionTime   0
QuickTime:SelectionDuration   0
QuickTime:CurrentTime   0
QuickTime:NextTrackID   3
QuickTime:MovieDataSize   4557092
QuickTime:MovieDataOffset   24194
Track1:TrackHeaderVersion   0
Track1:TrackCreateDate   0000:00:00 00:00:00
Track1:TrackModifyDate   0000:00:00 00:00:00
Track1:TrackID   1
Track1:TrackDuration   73.346
Track1:TrackLayer   0
Track1:TrackVolume   0
Track1:MatrixStructure   1 0 0 0 1 0 0 0 1
Track1:ImageWidth   360
Track1:ImageHeight   640
Track1:MediaHeaderVersion   0
Track1:MediaCreateDate   0000:00:00 00:00:00
Track1:MediaModifyDate   0000:00:00 00:00:00
Track1:MediaTimeScale   14861
Track1:MediaDuration   73.3463427763946
Track1:MediaLanguageCode   und
Track1:HandlerType   vide
Track1:HandlerDescription   ISO Media file produced by Google Inc.
Track1:CompressorID   avc1
Track1:SourceImageWidth   360
Track1:SourceImageHeight   640
Track1:XResolution   72
Track1:YResolution   72
Track1:BitDepth   24
Track1:VideoFrameRate   29.722
Track1:GraphicsMode   0
Track1:OpColor   0 0 0
Track2:TrackHeaderVersion   0
Track2:TrackCreateDate   0000:00:00 00:00:00
Track2:TrackModifyDate   0000:00:00 00:00:00
Track2:TrackID   2
Track2:TrackDuration   73.445
Track2:TrackLayer   0
Track2:TrackVolume   1
Track2:MatrixStructure   1 0 0 0 1 0 0 0 1
Track2:MediaHeaderVersion   0
Track2:MediaCreateDate   0000:00:00 00:00:00
Track2:MediaModifyDate   0000:00:00 00:00:00
Track2:MediaTimeScale   44100
Track2:MediaDuration   73.444716553288
Track2:MediaLanguageCode   eng
Track2:HandlerType   soun
Track2:HandlerDescription   ISO Media file produced by Google Inc.
Track2:AudioFormat   mp4a
Track2:AudioChannels   2
Track2:AudioBitsPerSample   16
Track2:AudioSampleRate   44100
Track2:Balance   0
Composite:AvgBitrate   496381
Composite:ImageSize   360x640
Composite:Megapixels   0.2304
Composite:Rotation   0

StarGeek

The filename indicates a date of 2019-11-10 21:46:47, November 10, 2020 at 9:46:47 PM (not sure where you get November 11th).  But that doesn't mean much, as it can be easily renamed from a variety of sources or if it's from a social media site, the date it was uploaded for example.

The System:FileModifyDate, System:FileAccessDate, and System:FileInodeChangeDate timestamps are file system timestamps, part of the underlying OS, and not reliable, especially if the video has been downloaded from the net or copied in some way from the original source.

There's nothing else in the file to indicate the original date.
* Did you read FAQ #3 and use the command listed there?
* Please use the Code button for exiftool code/output.
 
* Please include your OS, Exiftool version, and type of file you're processing (MP4, JPG, etc).

vscav12345

Is there any data to infer what kind of device the video was filmed on ? A phone camera or a regular video camera? Also, the video was not uploaded from a social media site, that I am fairly certain of. If anything it was uploaded to a pc and then sent to the recipient's phone (a Google pixel 3). What about that ISO media Google bit? What is that in reference to? Finally, if it was sent filmed on that November 10th date why isn't the "filmed on" date referenced anywhere in the exif? I appreciate your feedback

Phil Harvey

The metadata has been basically stripped from this video.  All that is left are the tags necessary to actually play the video.  No additional information at all.  Even the necessary date/time tags are set to zero.  If the video wasn't recoded, there may be some date/time information embedded in the video stream, but ExifTool won't extract this.

- Phil
...where DIR is the name of a directory/folder containing the images.  On Mac/Linux/PowerShell, use single quotes (') instead of double quotes (") around arguments containing a dollar sign ($).

StarGeek

Quote from: vscav12345 on December 16, 2020, 03:15:18 AMIf anything it was uploaded to a pc and then sent to the recipient's phone (a Google pixel 3).

Depending how it was sent, that might strip away any personal data.  A lot of apps do this and any app that would have re-compressed it in some way would do so as well

QuoteWhat about that ISO media Google bit? What is that in reference to?

Seems likely that some google related program/app has processed it in some way.

QuoteFinally, if it was sent filmed on that November 10th date why isn't the "filmed on" date referenced anywhere in the exif?

(Minor nitpick, EXIF is only one type of metadata.  All EXIF data is metadata but not all metadata is EXIF data.  Video data spec is Quicktime)

It may never have been in the video.  There's no way of knowing.  Programs which make videos are not forced to add timestamps or anything identifiable at all to a video.  And the lazier a programmer is, the less likely it will have any useful data.
* Did you read FAQ #3 and use the command listed there?
* Please use the Code button for exiftool code/output.
 
* Please include your OS, Exiftool version, and type of file you're processing (MP4, JPG, etc).

vscav12345

Phil, How would I go about capturing the embedded date and time from the video if it wasn't recoded?  Does the fact that all the information was stripped tell you anything as to the nature of the video i.e. if it is a secondary copy uploaded from a pc and then sent?[size=78%] [/size]

StarGeek

* Did you read FAQ #3 and use the command listed there?
* Please use the Code button for exiftool code/output.
 
* Please include your OS, Exiftool version, and type of file you're processing (MP4, JPG, etc).

Phil Harvey

Quote from: vscav12345 on December 17, 2020, 12:06:46 AM
Does the fact that all the information was stripped tell you anything as to the nature of the video

It says something about the software that (re?)coded the video (ie. apparently Google software), but it is unlikely that you would be able to tell the original source.

- Phil
...where DIR is the name of a directory/folder containing the images.  On Mac/Linux/PowerShell, use single quotes (') instead of double quotes (") around arguments containing a dollar sign ($).