News:

2023-08-10 - ExifTool version 12.65 released

Main Menu

Altered Metadata

Started by Kyle6565, November 12, 2021, 02:01:58 PM

Previous topic - Next topic

Kyle6565

Hey all. I wanted to see if someone can help me find out whether a photo was altered as I'm new to the metadata world. I have reason to suspect my gf bought a pic online or something and re did the data on it. I've looked at it on forensically and there. Are a lot of strange things about it but I can't pin it down

StarGeek

There  are no obvious signs in the metadata that it has been edited.  That doesn't mean it hasn't.  It just means if someone did, they were good enough to duplicate the metadata of the original.
* Did you read FAQ #3 and use the command listed there?
* Please use the Code button for exiftool code/output.
 
* Please include your OS, Exiftool version, and type of file you're processing (MP4, JPG, etc).

Kyle6565

When you pull up the gps quardinates though it shows the photo was taken in the opposite direction the car was moving

StarGeek

I wouldn't know about that.  I'm just saying that if the data had been changed with a program such as Lightroom or similar program, there would be a significant amount of extra data that programs like that would add.  I'm not saying it wasn't altered, but it would take a reasonable amount of tech savvy to do so.

Split into it's own thread since the post had nothing to do with LensID discoveries.
* Did you read FAQ #3 and use the command listed there?
* Please use the Code button for exiftool code/output.
 
* Please include your OS, Exiftool version, and type of file you're processing (MP4, JPG, etc).

Phil Harvey

I've compared this sample to an original iPhone6s sample I have here.  This is the best way to look for structural differences.  There were differences, but nothing that couldn't be attributed to a different version of iOS.  For a more detailed analysis, an original sample from the same camera and iOS version would be required.

- Phil
...where DIR is the name of a directory/folder containing the images.  On Mac/Linux, use single quotes (') instead of double quotes (") around arguments containing a dollar sign ($).