IPTC tags detection problem

[11august]

Hello all!

Working with a friend on a long-term project that intend to detect "suspect tags" in photo's metadata after software modifications, we came up with a problem with IPTC tags detection.

Our own software use the Exiv2 lib and is able to extract all the raw metadata for a given photo.

The problem is about two identical photos (or only one modified and re-saved afterwards?) taken with an Iphone 5C (GSM) and Retrica filters. I don't know about the history of these photos and it's quite possible that at some point some further manipulations were done, at least on one of them, I have no idea of what have been done though. One of these photos have XMP + IPTC tags and the other only IPTC tags; oddly, these tags are perfectly detected by our software for the first one but NOT for the second.

As for EXIFTool, it perfectly do its job indicating, on both images, that there are some IPTC tags ("IPTC Digest" and "Current IPTC Digest"). BTW, the Current IPTC value of the first photo is identical to that of the IPTC Digest value of the second photo (the one whose tags are "detected" by Exiv2 and our soft).

The odd parts and the things that I don't understand are:

1- If, like I strongly suspect, this is only one photo that have been modified and re-saved (BTW how, as there are no further traces of any other modifications in the EXIF!?), how is it possible that Exiv2 do not read anything about IPTC tags on one of these photos while EXIFTool do?

2- How exactly is generated by EXIFTool the value of these two IPTC tags?

3- Any idea of what could have been done to the "original" photo that allows the generation of the same value in the Current IPTC tag to that of the IPTC Digest of the second photo?

Any help would be greatly appreciated! 

PS: the two photos in question are attached.

[StarGeek]

1)  Neither of these tags are IPTC tags.  Exiv2 probably doesn't calculate the current digest (I only found a three year old thread on the subject).  I have no idea if it reads any of the Photoshop tags.  As for modification traces, I doubt most software leaves any trace of any modifications it makes to EXIF or IPTC data.  I believe those tags are very structured and ordered and wouldn't change regardless of the software.  With XMP, exiftool does write XMPToolkit with its name and the current version, but you can also change that to anything you want.  XMP is also more a open form, and if you really wanted to, you could analyze the way exiftool writes its XMP and compare that to the way Photoshop writes XMP to see if there are differences.  But then again, not many cameras write XMP in the first place (or IPTC for that matter), so the existence of those tags in the first place might be a clue.   Ah, wait, found at least one exception.  At the very least some Apple phones seem to write face regions to XMP.  And then some software used to copy images off of cameras, such as Nikon Transfer, edits the metadata as it copies.  So, minimal XMP, maybe IPTC, could exist in a file.  But rich, extensive IPTC or XMP metadata is unlikely unless the file has been edited.

2) CurrentIPTCDigest is not a tag in the file.  See Extra Tags.  It is an MD5 digest of existing IPTC data that exiftool computes so it can be inserted into IPTCDigest when IPTC tags and XMP tags are properly synced according to the MWG specifications.  See MWG tags for more info.

IPTCDigest is not an IPTC tag.  It is saved in the Photoshop block.  It is the MD5 digest value of the IPTC data when it was synced with the XMP data.  It obviously can't be saved in the IPTC block because the act of adding it would change the MD5 value.

3) Since both CurrentIPTCDigest values are identical, that means the IPTC block is exactly the same in each image.  The fact that one image has an IPTCDigest tag and XMP tags is a likely indicator that that image has been at least loaded into a program that is aware of the IPTCDigest tag, such as Lightroom.

[11august]

Thank you StarGeek for this long and precise answer!

Very useful