Why is there no file history in an edited file?

Started by AL10, January 13, 2018, 08:21:12 PM

Previous topic - Next topic

AL10

My main purpose for using the exiftool is to help me determine if i have an original, non-edited photo. One of the variables I always look for to help me determine this is for me to see if there is a return regarding any history (ex. "History Software Agent","History Action"....), or anything pertaining to software which would indicated it could have been opened up in software and edited.

However I recently ran the exiftool on photo from someone that I know was edited but the exiftool did not return data pertaining to file history or software. The reason I know the file was edited is because it has been cropped by the photographer and watermarked yet there is no trace in the exiftool return that shows what software it was opened in nor any history. Can someone explain this to me? SHould I not be looking for these variables to help me determine if I have an original, non-edited photo right out of the camera?

I've attached what the exiftool has returned but deleted some data pertaining to personal identity.

StarGeek

Most software doesn't save a history.  The only place I see such data is from images exported from Lightroom/Photoshop or similar software that tend to do non-destructive edits.  Programs such as Irfanview, MS Paint, or ImageMagic could easily crop and watermark and wouldn't leave any metadata trace.
* Did you read FAQ #3 and use the command listed there?
* Please use the Code button for exiftool code/output.
 
* Please include your OS, Exiftool version, and type of file you're processing (MP4, JPG, etc).

AL10

So then how do I determine if an image has been modified? I would always look for hints of any software used, or file history. Are there other attributes that would help me determine if this file has been retouched/manipulated??? Any other factors would be appreciated. Obvious things like the file size are easy to spot since its not a usual file size and resolution from a Canon 5D.

I've also attached the whats suppose to be the original raw file to this message now. To me this raw file seems fine once again since there nothing showing that it was opened in any software nor is there any file history.


P.S. I am using other techniques but I would really like to implement the exiftool to help me determine the likely hood of a file being modified right off hand.

Phil Harvey

This thread has a large overlap with your other post.  Maybe I should combine them into one thread.
...where DIR is the name of a directory/folder containing the images.  On Mac/Linux/PowerShell, use single quotes (') instead of double quotes (") around arguments containing a dollar sign ($).

AL10

That could get confusing. I will stick to commenting on the other thread from this point on.