exiftool footprints

[Archive]

[Originally posted by shortcipher on 2008-08-10 09:38:01-07]

Does exiftool leave footprints: is it possible to tell whether a JPEG file, for example has been modified by exiftool?
If I write to a JPEG file, writing a tag without changing its value, the file contents do change in subtle ways, but I don't know whether the changes provide consistent evidence of exiftool's activity...

[Archive]

[Originally posted by exiftool on 2008-08-15 12:03:17-07]

ExifTool structures EXIF information in a standard way, but not
all images are structured this way to begin with.  So the
file structure of the edited image may be different, and an
expert (like me) may be able to tell that some information has been
edited.

 - Phil

[Archive]

[Originally posted by shortcipher on 2008-08-16 03:27:29-07]

If you take a file already modified by exiftool, and rewrite it with a null change (e.g. write a tag without changing its current value), the file doesn't change at all. The same procedure would almost certainly change a file not already modified by exiftool, e.g. original file from camera. This would be quite a powerful forensic tool for detecting an exiftool footprint. I realised this after my original post.