Is Exif information %100 dependent on Hex data?

Started by AL10, January 22, 2019, 04:02:02 PM

Previous topic - Next topic

AL10

This is a bit of a silly question that I just need confirmation with.

When retrieving exif information, such as the camera model, software history....etc.....does the exifttool just pull that information from the hex information stored in the image? Essentially, I want to see if an image was opened in another software. However, someone could easily remove that exif information showing it was opened in another software. In order for someone to remove that exif information would they have to remove the hex information showing the software used, or can they just alter the exif information independently of the hex information?

Phil Harvey

I don't know what you mean by hex information.  You can use Exiftool or other metadata software to change any of the meta information in a file.

- Phil
...where DIR is the name of a directory/folder containing the images.  On Mac/Linux/PowerShell, use single quotes (') instead of double quotes (") around arguments containing a dollar sign ($).

AL10

By hex information I mean the htmldump file.  What I want to know is if someone can edit the output of the exif information while keeping the htmldump file intact/not edited.

Phil Harvey

Ah.  One can always use a hex editor to do that.

- Phil
...where DIR is the name of a directory/folder containing the images.  On Mac/Linux/PowerShell, use single quotes (') instead of double quotes (") around arguments containing a dollar sign ($).

AL10

Right but can someone generate fake/modified EXIF information while keeping the hex/html dump file intact?

Phil Harvey

I don't know what you mean by keeping the hex/html intact.  The hex html dump is a hex representation of the EXIF information.  Do you mean to edit the information while keeping the EXIF valid?  Or while maintaining the same structure?  Or while keeping the same byte positions for all of the information?  The answer is yes to all of these.
...where DIR is the name of a directory/folder containing the images.  On Mac/Linux/PowerShell, use single quotes (') instead of double quotes (") around arguments containing a dollar sign ($).

AL10

This answered my question" "Do you mean to edit the information while keeping the EXIF valid". Essentially the EXIF information is derived from from the hex/html dump file, correct?. BUT i did not know if someone can just edit the EXIF with out editing the htmldump/hex information.

Alan Clifford

Quote from: AL10 on January 25, 2019, 07:13:51 PM
Essentially the EXIF information is derived from from the hex/html dump file, correct?.

No, incorrect.  The exif informatoon is not "derived" from the hex data.  the exif information IS the hex data in another format.