How to access original exif information when exif information changes

Started by kaslan2017, March 03, 2018, 08:21:04 PM

Previous topic - Next topic

kaslan2017

The Iphone 5 s phone lasted for a while. When I checked, I noticed that 3 photos did not belong to me. However, the dates when these photos were uploaded to the phone belong to my time. I realized that I did not take my phone out of control with ExifTool. Is it possible to determine exactly by which method these photos (whatsap, mesenger ...) were uploaded by which date? How is it possible? Also if the exif information of these photos is changed correct information How to reach?


StarGeek

This is something you'll have to research yourself.  Run exiftool on the three files and look to see if there's anything obvious that indicates the origin.

But I think that it's very unlikely that there would be any info there as programs that don't create images, just pass them along, usually don't edit the metadata.
* Did you read FAQ #3 and use the command listed there?
* Please use the Code button for exiftool code/output.
 
* Please include your OS, Exiftool version, and type of file you're processing (MP4, JPG, etc).

kaslan2017

mail address or you can send me pictures at any time. because my talents are not enough to understand what you say.

Phil Harvey

If you email me the pictures I'll take a look.  (philharvey66 at gmail.com)

- Phil
...where DIR is the name of a directory/folder containing the images.  On Mac/Linux/PowerShell, use single quotes (') instead of double quotes (") around arguments containing a dollar sign ($).

kaslan2017


Phil Harvey

I got the images.  As you said in your mail, these images contain only very basic EXIF information.  The software that wrote these didn't leave any obvious signs of what it was.  The thumbnail images correspond to the main image, which is good.  The metadata for all these files is structured in exactly the same way and contains the same padding after the thumbnail, which is may be an indication that the metadata wasn't modified by software on a computer.  (Small devices tend to leave padding like this, but big software does not.)

However, one would expect a make/model if this is from an original camera.  I can't recall any cameras that would write the metadata in exactly the format of these files.  Do you have any idea what camera took these pictures?  If you know the model then it would be very helpful in determining whether the images were edited.

- Phil
...where DIR is the name of a directory/folder containing the images.  On Mac/Linux/PowerShell, use single quotes (') instead of double quotes (") around arguments containing a dollar sign ($).

kaslan2017


kaslan2017

Could these pictures be taken back the date of the phone? phone iphone 5s. My English is not very good. I am using google translator. the room can not turn very well. I could not tell exactly what I wanted to say in the previous message.

Phil Harvey

These do not look like original images from the iPhone 5S.  Something else took these pictures or edited them.

- Phil
...where DIR is the name of a directory/folder containing the images.  On Mac/Linux/PowerShell, use single quotes (') instead of double quotes (") around arguments containing a dollar sign ($).