Main Menu

Detection of ExifTool usage

Started by Juggernaut, June 04, 2018, 07:32:22 AM

Previous topic - Next topic

Juggernaut

Is there any software, that can detect, that file was modified by ExifTool?

Are there any "fingerprints", that can be left by ExifTool "under the hood" of meta tags of file?


Phil Harvey

#1
By default, ExifTool will write the XMPToolkit tag with its version number when writing XMP, but you can override this with whatever you want.

Otherwise, the only hint would be the structure of the metadata.  For example, many digital cameras leave unused spaces in EXIF metadata, but ExifTool won't do this.

- Phil

Edit: Fixed typo
...where DIR is the name of a directory/folder containing the images.  On Mac/Linux/PowerShell, use single quotes (') instead of double quotes (") around arguments containing a dollar sign ($).

Juggernaut

Quote from: Phil Harvey on June 04, 2018, 08:09:25 AM
By default, ExifTool write write the XMPToolkit tag with its version number when writing XMP, but you can override this with whatever you want.

Otherwise, the only hint would be the structure of the metadata.  For example, many digital cameras leave unused spaces in EXIF metadata, but ExifTool won't do this.

- Phil

What do you mean by "unused spaces" ? Is it tags with no values, just spaces ? Or its something like "Canon      Model123" ?

And if I get you right, ExifTool cannot do anything like this, at all? So, ExifTool cannot make changes that will pretend to be original meta tags of digital camera ?

Phil Harvey

I'm talking about unused space in the file.  Take a look at the ExifTool -htmlDump output for a few files before and after editing with ExifTool.

See here for an explanation.

- Phil
...where DIR is the name of a directory/folder containing the images.  On Mac/Linux/PowerShell, use single quotes (') instead of double quotes (") around arguments containing a dollar sign ($).

Juggernaut

I'm still, as newbie, don't understand what do you mean by "unused space" in file  :D

But anyway, I've got excited and have done html dumps (before using ExifTool and after), did it with a photo.jpg (photo from a cellphone) ... and I did not find any differences at all.

I've modified the tag FileCreateDate

Or not all tags after modifying can cause cleaning of "unused space" ?

Or is it because I need photo from digital camera like Canon/Nikon, and not like camera from cellphone ?

Phil Harvey

FileCreateDate isn't metadata in the file.  This is what I call a "pseudo" tag, and is stored in the directory of the filesystem (see the Extra tags documentation --> The Writable System "pseudo" tags in this table may be written without modifying the file itself.).  Try modifying one of the EXIF tags instead.

- Phil
...where DIR is the name of a directory/folder containing the images.  On Mac/Linux/PowerShell, use single quotes (') instead of double quotes (") around arguments containing a dollar sign ($).