Author Topic: Proof of tampered image/metadata  (Read 303 times)


  • Jr. Member
  • **
  • Posts: 29
Proof of tampered image/metadata
« on: January 03, 2019, 11:51:06 PM »
I've received an image from a Hasselblad H4D-40 camera. I ran the exiftool to see if I can identify if this image was opened in any software to help me identify if this is an original captured raw file. I see there are a few warnings mentioned but I'm not sure what they stand for. Any help with that would be much appreciated.

Other then that, the data returned from the exiftool does not show any signs that this image was tampered with. I am running a variety of other forensic tests and not only relying on this tool but regarding the metadata, I was curious to see if anyone else sees anything suspicious. I've worked mainly with Canon and Nikon cameras but this is the first time I come across a camera like this so I was hoping for some extra feedback.

I've attached the what the exiftool returned to this message. I changed the directory as it showed personal information.

Phil Harvey

  • ExifTool Author
  • Administrator
  • ExifTool Freak
  • *****
  • Posts: 16308
    • ExifTool Home Page
Re: Proof of tampered image/metadata
« Reply #1 on: January 04, 2019, 07:01:03 AM »
The way to tell is to compare with an original file from the camera if you can get one.  I don't have a sample myself so I can't comment on what the camera writes originally.

- Phil
...where DIR is the name of a directory/folder containing the images.  On Mac/Linux, use single quotes (') instead of double quotes (") around arguments containing a dollar sign ($).