Help interpreting metadata to determine when a video was filmed - creation date

[ers99w]

Hello!

Firstly, I'm a complete newbie to metadata and don't know how to code - I barely figured out how to use the command line to use ExifTool, so thank you for your patience with my ignorance.

I'm trying to figure out if a video sent to me via email was filmed on the date that the creator says it was, and I google searched my way to ExifTools to get a list of dates using "exiftool -time:all -a -G1 video.mov". The video was filmed using an iPhone.

Can anyone more knowledgeable than me interpret the results, below? Everything seems to match when the creator said they filmed the video (May 20) and when I was forwarded the video and move the file to my computer from my email (May 21), but the "Creation Date" says May 3rd:

Code Select Expand

[System]        File Modification Date/Time    : 2024:05:21 11:30:00+12:00
[System]        File Access Date/Time          : 2024:05:21 13:54:17+12:00
[System]        File Creation Date/Time        : 2024:05:20 18:39:00+12:00
[QuickTime]     Create Date                    : 2024:05:20 06:34:22
[QuickTime]     Modify Date                    : 2024:05:20 06:34:23
[Track1]        Track Create Date              : 2024:05:20 06:34:22
[Track1]        Track Modify Date              : 2024:05:20 06:34:23
[Track1]        Media Create Date              : 2024:05:20 06:34:22
[Track1]        Media Modify Date              : 2024:05:20 06:34:23
[Track2]        Track Create Date              : 2024:05:20 06:34:22
[Track2]        Track Modify Date              : 2024:05:20 06:34:23
[Track2]        Media Create Date              : 2024:05:20 06:34:22
[Track2]        Media Modify Date              : 2024:05:20 06:34:23
[Track3]        Track Create Date              : 2024:05:20 06:34:22
[Track3]        Track Modify Date              : 2024:05:20 06:34:23
[Track3]        Media Create Date              : 2024:05:20 06:34:22
[Track3]        Media Modify Date              : 2024:05:20 06:34:23
[Track4]        Track Create Date              : 2024:05:20 06:34:22
[Track4]        Track Modify Date              : 2024:05:20 06:34:23
[Track4]        Media Create Date              : 2024:05:20 06:34:22
[Track4]        Media Modify Date              : 2024:05:20 06:34:23
[Track5]        Track Create Date              : 2024:05:20 06:34:22
[Track5]        Track Modify Date              : 2024:05:20 06:34:23
[Track5]        Media Create Date              : 2024:05:20 06:34:22
[Track5]        Media Modify Date              : 2024:05:20 06:34:23
[Keys]          Creation Date                  : 2024:05:03 09:11:46+12:00
What are the explanations for why the Creation Date says May 3 but all of the other dates are more recent?

Thank you VERY much!

[wywh]

I get the same effect if I now (2024:05:21 08:47:43) take a 4 second movie with iPhone or iPad (iOS 15.8.2 or iPadOS 17.4.1), adjust its date in the iPhone or iPad to 2024:05:03 09:11, and send it via the default AirDrop setting to the Mac.

'Keys:CreationDate' is the time where I set it and 'QuickTime:CreateDate' is the time when I adjusted it a minute after I took the movie:

Code Select Expand

exiftool -a -G1 -s -api QuickTimeUTC=1 -Time:All IMG_2438.MOV
[System]        FileModifyDate                  : 2024:05:21 08:48:45+03:00
[System]        FileAccessDate                  : 2024:05:21 08:48:45+03:00
[System]        FileInodeChangeDate             : 2024:05:21 08:49:05+03:00
[QuickTime]     CreateDate                      : 2024:05:21 08:48:45+03:00
[QuickTime]     ModifyDate                      : 2024:05:21 08:48:45+03:00
[Track1]        TrackCreateDate                 : 2024:05:21 08:48:45+03:00
[Track1]        TrackModifyDate                 : 2024:05:21 08:48:45+03:00
[Track1]        MediaCreateDate                 : 2024:05:21 08:48:45+03:00
[Track1]        MediaModifyDate                 : 2024:05:21 08:48:45+03:00
[Track2]        TrackCreateDate                 : 2024:05:21 08:48:45+03:00
[Track2]        TrackModifyDate                 : 2024:05:21 08:48:45+03:00
[Track2]        MediaCreateDate                 : 2024:05:21 08:48:45+03:00
[Track2]        MediaModifyDate                 : 2024:05:21 08:48:45+03:00
[Track3]        TrackCreateDate                 : 2024:05:21 08:48:45+03:00
[Track3]        TrackModifyDate                 : 2024:05:21 08:48:45+03:00
[Track3]        MediaCreateDate                 : 2024:05:21 08:48:45+03:00
[Track3]        MediaModifyDate                 : 2024:05:21 08:48:45+03:00
[Track4]        TrackCreateDate                 : 2024:05:21 08:48:45+03:00
[Track4]        TrackModifyDate                 : 2024:05:21 08:48:45+03:00
[Track4]        MediaCreateDate                 : 2024:05:21 08:48:45+03:00
[Track4]        MediaModifyDate                 : 2024:05:21 08:48:45+03:00
[Track5]        TrackCreateDate                 : 2024:05:21 08:48:45+03:00
[Track5]        TrackModifyDate                 : 2024:05:21 08:48:45+03:00
[Track5]        MediaCreateDate                 : 2024:05:21 08:48:45+03:00
[Track5]        MediaModifyDate                 : 2024:05:21 08:48:45+03:00
[Keys]          CreationDate                    : 2024:05:03 09:11:00+03:00
On the other hand, with AirDrop setting "All Photos Data" all dates are as original:

Code Select Expand

exiftool -a -G1 -s -api QuickTimeUTC=1 -Time:All IMG_2438.MOV
[System]        FileModifyDate                  : 2024:05:21 08:47:43+03:00
[System]        FileAccessDate                  : 2024:05:21 08:47:43+03:00
[System]        FileInodeChangeDate             : 2024:05:21 08:53:07+03:00
[QuickTime]     CreateDate                      : 2024:05:21 08:47:43+03:00
[QuickTime]     ModifyDate                      : 2024:05:21 08:47:47+03:00
[Track1]        TrackCreateDate                 : 2024:05:21 08:47:43+03:00
[Track1]        TrackModifyDate                 : 2024:05:21 08:47:47+03:00
[Track1]        MediaCreateDate                 : 2024:05:21 08:47:43+03:00
[Track1]        MediaModifyDate                 : 2024:05:21 08:47:47+03:00
[Track2]        TrackCreateDate                 : 2024:05:21 08:47:43+03:00
[Track2]        TrackModifyDate                 : 2024:05:21 08:47:47+03:00
[Track2]        MediaCreateDate                 : 2024:05:21 08:47:43+03:00
[Track2]        MediaModifyDate                 : 2024:05:21 08:47:47+03:00
[Track3]        TrackCreateDate                 : 2024:05:21 08:47:43+03:00
[Track3]        TrackModifyDate                 : 2024:05:21 08:47:47+03:00
[Track3]        MediaCreateDate                 : 2024:05:21 08:47:43+03:00
[Track3]        MediaModifyDate                 : 2024:05:21 08:47:47+03:00
[Track4]        TrackCreateDate                 : 2024:05:21 08:47:43+03:00
[Track4]        TrackModifyDate                 : 2024:05:21 08:47:47+03:00
[Track4]        MediaCreateDate                 : 2024:05:21 08:47:43+03:00
[Track4]        MediaModifyDate                 : 2024:05:21 08:47:47+03:00
[Track5]        TrackCreateDate                 : 2024:05:21 08:47:43+03:00
[Track5]        TrackModifyDate                 : 2024:05:21 08:47:47+03:00
[Track5]        MediaCreateDate                 : 2024:05:21 08:47:43+03:00
[Track5]        MediaModifyDate                 : 2024:05:21 08:47:47+03:00
[Keys]          CreationDate                    : 2024:05:21 08:47:43+03:00
Also via USB original metadata is always copied.

p.s. I almost always use that '-api QuickTimeUTC' when checking dates because it adjusts movie dates from UTC to computer's local time so they sync with image times where that option has no effect.

- Matti

[ers99w]

Wow, thank you so much!

Does that mean that for the video I was sent, the most likely sequence of events is that the video was filmed on May 3 and air dropped to their mac on May 20, emailed May 21, etc.? Would that recreate the pattern I get from Exiftools?


This is what I get when including 'api QuicktimeUTC' in the command that you suggested:

Code Select Expand

[System]        FileModifyDate                 : 2024:05:21 11:30:00+12:00
[System]        FileAccessDate                 : 2024:05:21 14:25:26+12:00
[System]        FileCreateDate                 : 2024:05:20 18:39:00+12:00
[QuickTime]     CreateDate                     : 2024:05:20 18:34:22+12:00
[QuickTime]     ModifyDate                     : 2024:05:20 18:34:23+12:00
[Track1]        TrackCreateDate                : 2024:05:20 18:34:22+12:00
[Track1]        TrackModifyDate                : 2024:05:20 18:34:23+12:00
[Track1]        MediaCreateDate                : 2024:05:20 18:34:22+12:00
[Track1]        MediaModifyDate                : 2024:05:20 18:34:23+12:00
[Track2]        TrackCreateDate                : 2024:05:20 18:34:22+12:00
[Track2]        TrackModifyDate                : 2024:05:20 18:34:23+12:00
[Track2]        MediaCreateDate                : 2024:05:20 18:34:22+12:00
[Track2]        MediaModifyDate                : 2024:05:20 18:34:23+12:00
[Track3]        TrackCreateDate                : 2024:05:20 18:34:22+12:00
[Track3]        TrackModifyDate                : 2024:05:20 18:34:23+12:00
[Track3]        MediaCreateDate                : 2024:05:20 18:34:22+12:00
[Track3]        MediaModifyDate                : 2024:05:20 18:34:23+12:00
[Track4]        TrackCreateDate                : 2024:05:20 18:34:22+12:00
[Track4]        TrackModifyDate                : 2024:05:20 18:34:23+12:00
[Track4]        MediaCreateDate                : 2024:05:20 18:34:22+12:00
[Track4]        MediaModifyDate                : 2024:05:20 18:34:23+12:00
[Track5]        TrackCreateDate                : 2024:05:20 18:34:22+12:00
[Track5]        TrackModifyDate                : 2024:05:20 18:34:23+12:00
[Track5]        MediaCreateDate                : 2024:05:20 18:34:22+12:00
[Track5]        MediaModifyDate                : 2024:05:20 18:34:23+12:00
[Keys]          CreationDate                   : 2024:05:03 09:11:46+12:00

[wywh]

Maybe the original movie date was edited in some Apple mobile device at 2024:05:20 06:34:22 UTC to 2024:05:03 09:11:46+12:00 and then copied with default AirDrop settings to a Mac? Most (all?) metadata dates can be edited.

- Matti

[ers99w]

Maybe, but that'd be a wild thing for this person to do, if they are claiming that they took the vid on May 20! I'm quite confused still, but thank you very much for answering my questions!