TrackModifyDate

[ErikF]

Hi,
Looking at some video files ( from Instagram )  on a mobile and several of them have a TrackModifyDate set 3-5 hours earlier than CreateDate. Anyone have any idea what this means?

[wywh]

Maybe Instagram does its own modifications to the dates?

QuickTime:CreateDate is usually used for sorting unless Keys:CreationDate overrides it in some apps. In my setup the difference between TrackCreateDate and TrackModifyDate seems to tell how long the ffmpeg encoding for that clip took. I haven't checked if that correlates to the clip length when it is shot. I currently set all possible dates the same to make troubleshooting easier.

[QuickTime]     CreateDate                      : 2019:01:10 16:59:23
[QuickTime]     ModifyDate                      : 2019:01:10 16:59:23
[Track1]        TrackCreateDate                 : 2019:01:10 16:59:23
[Track1]        TrackModifyDate                 : 2019:01:10 16:59:23

[Phil Harvey]

What is your time zone?  Try adding -api quicktimeutc to the command.

- Phil

[StarGeek]

Looking at some video files ( from Instagram )  on a mobile

With exiftool on mobile or something else? 

It's my experience that Instagram strips away all metadata.  I just downloaded a video and double checked and there wasn't any metadata in it.

[ErikF]

My timezone is UTC+1. I have exported the files from an extraction using a forensic tool.

Filepath is:\private\var\mobile\Containers\Data\Application\AE582B84-1496-483F-B2F4-F894B82B5887\Library\Caches\com.burbn.instagram.IGSparseVideoCache\da995859926bd065704a4803313b1a57

Running ExifTool 12.12 give following result ( see attachment )

[StarGeek]

All the timestamps in that file are not set except for the Track Modify Date.  The "Create Date" isn't embedded data, it's the OS system timestamp.  That timestamp is based upon when the file was created on that system.  There's not really any correlation between the track times and the system times.  If I downloaded the same video, "Create Date" would be today and it would be days off instead of hours.

[ErikF]

Thank you. If I understand it correct. The CreateDate says when the file was created ( downloaded ) on the device and TrackModifyDate indicate when the original file was recorded?

[StarGeek]

The CreateDate says when the file was created ( downloaded ) on the device

Most likely.

and TrackModifyDate indicate when the original file was recorded?

Maybe, though I would think that is unlikely since as I said, Instagram (and most social networks) strip away all metadata for privacy.  Though I suspect that it is more of a side effect of the re-encoding process they use to make videos easier to stream.