Forgotten in its old age

by Aditya

submit your photo


Hall of Fame
View past winners from this year

Please participate in Meta
and help us grow.

Take the 2-minute tour ×
Photography Stack Exchange is a question and answer site for professional, enthusiast and amateur photographers. It's 100% free, no registration required.

There was a photography contest and it was limited to only three days of shooting - but the winning photo seemed a little out of season.

So I suspect that the winner changed the metadata on the photo. Is there any way to detect if any changes have been made to metadata? Or any way to roll back to the original data?

share|improve this question
    
take a look at this site to see how easy it is to change the exif date: askubuntu.com/questions/101688/… –  woliveirajr Oct 4 '13 at 15:38
    
Even if there was some way to help I doubt it would apply to JPEGs, and every raw format (Canon/Nikon etc.) in the world. –  dcaswell Oct 6 '13 at 18:29
    
@kursat I'm not sure what you're hoping to get from the bounty here - you've got the answer, which is a pretty clear "no". A Stack Exchange bounty won't change that. –  Philip Kendall Oct 7 '13 at 8:28
    
can you supply the image here? the original, that he submitted to the contest... –  woliveirajr Oct 7 '13 at 13:48
    
Keep in mind that "out of season" could be achieved by being in a different location. It is summer in Argentina while it's winter in the US, for example. Elevation and percipitation changes can allow access to different climates for relatively small travel distances. –  Olin Lathrop Oct 8 '13 at 16:06

5 Answers 5

up vote 10 down vote accepted
+50

It is sadly impossible to to prove when an image (or any file for that matter) originated. It is possible (if the author wants to) to prove that a file existed prior to a given time by signing the file from a third party time stamping server (through which the third party proves that the file existed at the time of the signing) but such information is not automatically possible and can easily be stripped.

I am also an IT Security guy and there is no possible secure way to prove the creation date of any file if the user controls the system creating the file with current technology that I am aware of. The best bet would be a device with a locked clock that would have a hidden key store that the user shouldn't have access to and create a signature based on this so that they couldn't fake their own signature, but since the key must still reside in the device, it is still feasibly possible for someone to break as all the necessary information is in their possession, even if it is hard to get to.

As far as detecting an amateur job, there is generally a file creation date in meta data of the file system itself that could be examined and compared to the EXIF metadata, but if they are good at it, they will have altered both and there is some possibility of the file system values getting lost depending on how the file is transferred, so it may not even be reliable.

share|improve this answer

If it's done well, absolutely impossible to detect (it's just bits in a file). If it's done crudely, there may well be some tell-tale signs... but my personal guess would be that it hasn't been tampered with at all and it's just a good photographer.

share|improve this answer

After the fact it is pretty hard to tell unless the image has been posted somewhere else with a different time stamp or something along those lines. Keep in mind that it's pretty much always spring/summer/fall/winter somewhere and if they're global they may have legitimately taken that image (or altered it to look that way, depending on what your editing policy is for that contest).

For anyone looking to prove their case should they find themselves being suspect of tampering, Canon has a custom function on some cameras to "add image verification data" which basically signs each image. Now, this won't prevent someone from changing the time on the camera prior to taking the picture, but it shows if the image has been edited afterwards. This is not meant for creative types, but for things that will be used as evidence in court and the like.

share|improve this answer
1  
Canon's custom verification was broken years ago. Tools exist to reset the verification after a file has been modified. –  James Snell Oct 9 '13 at 14:35
    
Interesting; I was unaware of that, though I can't say I'm surprised. –  tenmiles Oct 9 '13 at 15:11

If the only modification in the image file is related to the EXIF DateTime field, that can be changed easily without leaving any trace. It is possible to verify incompatibilities at files system level: ideally the EXIF DateTime should match with the Last Modification time set by the operating system, but this can be different for legit reasons, like a file copy, and in any case it can be simply overwritten by proper tools.

If you think that also some other modification occurred at pixel level, that is usually identified by the proper techniques. You can see some examples of analysis with a specialized tool for image forensics like Amped Authenticate (http://ampedsoftware.com/authenticate-samples - DISCLAIMER: I am the company founder).

share|improve this answer

If you are using Windows, just right-click the jpg and go to Properties. From there go to the Details tab and change the date to whatever you want.

So, the answer is it is pretty simple to do.

share|improve this answer
1  
It's simple. But the question was how can you detect if it's been done. –  MikeW Oct 8 '13 at 19:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.