Iphone Live photo - Jpeg and mov dates do not match.

[MbM]

There are a few posts asking how to correct this, but can someone explain to me why this is?

I have an iPhone live photo, two files, Jpeg and mov. The dates in the metadata from Exiftool do not match, although they are of the same moment. How can this be explained? The video is made from the photo at a later date by the user? Something to do with how it's saved in the structure? Any help would be great!

[StarGeek]

The dates should be off by the time zone.  Video time stamps are saved as UTC. Image time stamps are local to where the image was shot.

For example, I live on the West Coast, USA, -07:00 time zone currently. If I took a live photo today at noon, the jpeg would say "2024:07:06 12:00:00", but the video would say "2024:07:06 19:00:00".

[MbM]

Thanks for the swift reply! I'm still a little confused..

The picture was taken on 2024:06:27 21:29:03

The jpeg has these dates/times:

Code Select Expand

File Modification Date/Time    : 2024:06:30 17:58:00+02:00
Create Date                    : 2024:06:27 21:29:03.032-04:00
Date/Time Original             : 2024:06:27 21:29:03.032-04:00
Modify Date                    : 2024:06:27 21:29:03-04:00Also

Code Select Expand

Software                       : 17.5.1
Modify Date                    : 2024:06:27 21:29:03
Host Computer                  : iPhone 14
The mov has these dates/times:

Code Select Expand

File Modification Date/Time    : 2024:06:30 17:58:01+02:00
Create Date                    : 2024:06:28 09:56:03
Modify Date                    : 2024:06:28 09:56:03
Track Create Date              : 2024:06:28 09:56:03
Track Modify Date              : 2024:06:28 09:56:03
Media Create Date              : 2024:06:28 09:56:03
Media Modify Date              : 2024:06:28 09:56:03
When opening in Imatch it shows as all metadata being locked, as if it was never modified.

I can tell the following entries are when I received the file, many days later:

Code Select Expand

File Access Date/Time          : 2024:07:07 00:07:22+02:00
File Creation Date/Time        : 2024:07:07 00:05:38+02:00
Does this mean the file has been altered/modified after being taken?

[StarGeek]

Sorry, I should have said to use this command
exiftool -time:all -G1 -a -s /path/to/files/

That will show all the time stamps, including duplicates, and the groups they belong to

FileAccessDate can always be ignored. It will change whenever the file is opened or touched. FileCreateDate/FileModifyDate are not always accurate, depending upon the method used to copy the files. And the OS will update the FileModifyDate whenever the file is opened for writing, such as when exiftool edits the data without using the -P (-preserve) option.

How long is the video?
exiftool -G1 -a -s -Duration file.mov
Cameras are pretty inconsistent between makes/models as to if the time stamp they save is the time the video started recording or ended. But unless the video is very long, I don't think that will show anything useful.

From what I can see, the file system time stamps say your computer is in the +02:00 time zone. The image says it was taken in the -04:00 time zone. So the UTC for the image would be 2024:06:28 01:29:03.  Instead, the UTC time stamps in the video are an addition 8 hours 27 minutes afterwards. That's quite a big difference.  But the seconds are the same. I would think that it would be unlikely that an editing program changed the date/time but left the seconds intact. And many editing programs don't do a good job of keeping metadata intact.

Try this command
exiftool -G1 -a -s -Quicktime:all file.mov
My only Live Image sample shows the folowing tags
CleanApertureDimensions
ProductionApertureDimensions
EncodedPixelsDimensions
LocationAccuracyHorizontal
LivePhotoAuto
LivePhotoVitalityScore
LivePhotoVitalityScoringVersion
ApplePhotosVariationIdentifier
If the file had been edited (by something other than exiftool), then it's unlikely that any of these tags would have been transfered to the new copy

[MbM]

Your detailed reply is much appreciated! I guess my question now is, which of these dates are reliable and which are not, and why are they not. I got "FileAccessDate can always be ignored. It will change whenever the file is opened or touched. FileCreateDate/FileModifyDate are not always accurate," that is super helpful.

The data for exiftool -time:all -G1 -a -s /path/to/files/ is:
Jpeg:

Code Select Expand

[System]        FileModifyDate                 : 2024:06:30 17:58:00+02:00
[System]        FileAccessDate                 : 2024:07:07 15:56:45+02:00
[System]        FileCreateDate                 : 2024:07:07 00:05:38+02:00
[IFD0]          ModifyDate                     : 2024:06:27 21:29:03
[ExifIFD]      DateTimeOriginal                : 2024:06:27 21:29:03
[ExifIFD]      CreateDate                      : 2024:06:27 21:29:03
[ExifIFD]      OffsetTime                      : -04:00
[ExifIFD]      OffsetTimeOriginal              : -04:00
[ExifIFD]      OffsetTimeDigitized             : -04:00
[ExifIFD]      SubSecTimeOriginal              : 032
[ExifIFD]      SubSecTimeDigitized             : 032
[GPS]          GPSTimeStamp                    : 01:29:02
[GPS]          GPSDateStamp                    : 2024:06:28
[ICC-header]    ProfileDateTime                : 2022:01:01 00:00:00
[Composite]    SubSecCreateDate                : 2024:06:27 21:29:03.032-04:00
[Composite]    SubSecDateTimeOriginal          : 2024:06:27 21:29:03.032-04:00
[Composite]    SubSecModifyDate                : 2024:06:27 21:29:03-04:00
[Composite]    GPSDateTime                     : 2024:06:28 01:29:02Z
Mov:

Code Select Expand

[System]        FileModifyDate                 : 2024:06:30 17:58:01+02:00
[System]        FileAccessDate                 : 2024:07:07 15:57:45+02:00
[System]        FileCreateDate                 : 2024:07:07 15:57:43+02:00
[QuickTime]    CreateDate                      : 2024:06:28 09:56:03
[QuickTime]    ModifyDate                      : 2024:06:28 09:56:03
[Track1]        TrackCreateDate                : 2024:06:28 09:56:03
[Track1]        TrackModifyDate                : 2024:06:28 09:56:03
[Track1]        MediaCreateDate                : 2024:06:28 09:56:03
[Track1]        MediaModifyDate                : 2024:06:28 09:56:03
[Track2]        TrackCreateDate                : 2024:06:28 09:56:03
[Track2]        TrackModifyDate                : 2024:06:28 09:56:03
[Track2]        MediaCreateDate                : 2024:06:28 09:56:03
[Track2]        MediaModifyDate                : 2024:06:28 09:56:03
[Track3]        TrackCreateDate                : 2024:06:28 09:56:03
[Track3]        TrackModifyDate                : 2024:06:28 09:56:03
[Track3]        MediaCreateDate                : 2024:06:28 09:56:03
[Track3]        MediaModifyDate                : 2024:06:28 09:56:03
[Track4]        TrackCreateDate                : 2024:06:28 09:56:03
[Track4]        TrackModifyDate                : 2024:06:28 09:56:03
[Track4]        MediaCreateDate                : 2024:06:28 09:56:03
[Track4]        MediaModifyDate                : 2024:06:28 09:56:03
[Track5]        TrackCreateDate                : 2024:06:28 09:56:03
[Track5]        TrackModifyDate                : 2024:06:28 09:56:03
[Track5]        MediaCreateDate                : 2024:06:28 09:56:03
[Track5]        MediaModifyDate                : 2024:06:28 09:56:03
[Keys]          CreationDate                   : 2024:06:27 21:29:02-04:00
We do have the 21:29:02-04:00 in the CreationDate of the mov, which is only a second away from the Jpeg 21:29:03.032-04:00, unless I'm missing something. Is that the only matching time? Is that expected and is CreationDate normally reliable?

The duration of the video is only 2 seconds. Is it possible to change the length of an iPhone live photo?
[QuickTime]    Duration                        : 2.83 s

Using exiftool -G1 -a -s -Quicktime:all file.mov I can comfim it has all those tags with data. One other thing, the results from that command, do they contain any device specific details that could in any way dox a person? I don't see IMEI or anything like that. GPS location of where it was taken is fine.

[StarGeek]

We do have the 21:29:02-04:00 in the CreationDate of the mov, which is only a second away from the Jpeg 21:29:03.032-04:00, unless I'm missing something. Is that the only matching time? Is that expected and is CreationDate normally reliable?

Yes, that appears to be the only matching time.  I'm honestly at a loss as to why there's such a big gap between the correct time and most of the video time stamps. Is it reliable? In this case, yes, but depending upon the source, it may not be in other cases.

The duration of the video is only 2 seconds. Is it possible to change the length of an iPhone live photo?

It can only be changed by editing the video. Either with a command line program such as ffmpeg or some other video editing program. And doing so will cause some data to be lost, as most video editing programs are really poor at preserving metadata.

Using exiftool -G1 -a -s -Quicktime:all file.mov I can comfim it has all those tags with data.

The fact that it has those as well as having Tracks 3-5, makes it extremely unlikely it has been edited by any standard video editing program.  Track 1 would be the video data and track 2 would be the audio data. Any other track would have some other sort of data which most likely wouldn't be properly handled by editing the video.

One other thing, the results from that command, do they contain any device specific details that could in any way dox a person? I don't see IMEI or anything like that.

Definitely never something like the IMEI, but some cameras will write a serial number for the camera into the images and there may something similar for videos, but that would only be useful if you could attach the number to a known source. As an example, StolenCameraFinder searches the web for images with serial numbers, supposed to help you find your camera if it's been stolen, but it could also be used to match an image with an unknown source to an image to a known source. But since the most common place images/videos get posted is to social media such as Facebook/TikTok, there's nothing to worry about in those cases because those sites scrub the files of all metadata.

[MbM]

Could it be possible that someone takes it as a photo, then later clicks the option to make it into a Live photo, with the video, or vice versa? I don't have an iPhone to test it but I will later.

One other thing, I downloaded IMatch and it has the locked padlock symbol next to everything, is that reliable to say it has never been changed? Also the series of checks I ran from there - Verify files, Metadata mechanic/analysist - all came back as passed. Are these anything to rely on?

[StarGeek]

Could it be possible that someone takes it as a photo, then later clicks the option to make it into a Live photo, with the video, or vice versa? I don't have an iPhone to test it but I will later.

I wouldn't know, I don't have an iPhone. I'm just wondering how would the phone create a video out of something that has already happened and didn't record one at the time?

One other thing, I downloaded IMatch and it has the locked padlock symbol next to everything, is that reliable to say it has never been changed?

Looking at my IMatch, I don't see any padlocks next to pictures. Or even an option to set one. The only padlock I see is at the top, which is there to prevent you from changing any of the icons associated with the images.  See The Icon Lock help section.

What does the tool tip say when you mouse over the padlock?

But no, there's no easy way to tell that a file has never been changed. Standard programs will some things and add various tags that say what software was used. Those are the obvious things. But if a program like exiftool or exiv2 was used, the only real way would be to do a deep forensic analysis on how the data was saved in the file.  For example, often when a camera saves a file, there's a lot of extra unneeded space in the data, in order to speed up saving the file. After exiftool edits it, it will remove some of this padding  and leave the file a bit smaller.  See From [FAQ #13c, Why is my file smaller after I use ExifTool to write information?](https://exiftool.org/faq.html#Q13)

Also the series of checks I ran from there - Verify files, Metadata mechanic/analysist - all came back as passed. Are these anything to rely on?

I haven't used that before, but checking it now, no, there's nothing in there that would identify a file as changed.

It just shows possible places where tags haven't been synchronized. I assume that some of it might be exiftool's -validate option, but more likely some internal checks by Imatch.