tracing timeshift

[Archive]

[Originally posted by magpie on 2007-02-28 16:48:30-08]

Hi - wonder if anyone here can help?
If an EXIFtool was used to change DateTimeOriginal and  DateTimeDigitized
on a file of deleted digital images on a digital camera (Sony DSC-P92)
would  
a) the actual time of exposure according to the internal clock setting still be traceable
b) where would this be
c) would the EXIF information on a viewer  for the files indicate an alteration.

This is for a legal forensic query -
many thanks.

[Archive]

[Originally posted by exiftool on 2007-02-28 17:25:21-08]

The DSC-P92 stores 4 separate date/time values, which originally all contain
the same information when the picture is taken:

Code:

% ./exiftool ../pics/SonyDSC-P92.jpg -a -G1 -S | grep Date
[File] FileModifyDate: 2006:01:05 19:49:17
[IFD0] ModifyDate: 2004:04:21 20:14:46
[ExifIFD] DateTimeOriginal: 2004:04:21 20:14:46
[ExifIFD] CreateDate: 2004:04:21 20:14:46
[IFD1] ModifyDate: 2004:04:21 20:14:46

If only 2 date/time values were changed, the other values may still give you
the original time the picture was taken. (The FileModifyDate value isn't stored
in the image itself, but is filesystem date/time when the file was last modified.)

Also, there is a fair bit of unknown maker note information for this camera
which could potentially contain a timestamp, but you'd have to ask Sony about
this because I don't know of anything that can decode this information.

- Phil

[Archive]

[Originally posted by magpie on 2007-02-28 17:49:38-08]

Thanks Phil that's very helpful.