I'm wonder how to recover the original name of picture which was made by device (for example Camera or phone)? Is it possible? Let's say that someone make a photo and then change name of the .JPG file from 20110126_NX003.JPG to sunny_day.JPG. Is it possible to find this original name given by the device if we have only this sunny_day.JPG file?
-
\$\begingroup\$ This may be documented somewhere but you could test it yourself by renaming some test files and inspecting the resulting EXIF metadata (i.e., perhaps with EXIFTool). I don't recall this being "standard" EXIF but some software that generates the EXIF and "MakerNotes" might save the original name. \$\endgroup\$– user31502Commented Jan 15, 2019 at 14:54
-
2\$\begingroup\$ vtc b/c This is a computer forensics question better asked at superuser.SE. \$\endgroup\$– xiotaCommented Jan 15, 2019 at 23:31
4 Answers
Experimentally I can't find any reference to the file name in the JPG picture files either from my Canon 70D camera or my smartphone.
Not surprising since a filename is just a label on things.
However, pictures from my phone are named using a timestamp:
IMG_20181224_181601856.jpg
And this matches two fields in the EXIF data:
5) DateTimeOriginal = 2018:12:24 18:16:01
6) CreateDate = 2018:12:24 18:16:01
But the last digits (856
) don't match other EXIF data:
17) SubSecTime = 918503
18) SubSecTimeOriginal = 918503
19) SubSecTimeDigitized = 918503
So this may not be sufficient to retrieve the full file name, but enough to know at what time the picture was taken, if this is what you wanted the initial filename for.
Whatever your OS, there are many tools around to view EXIF data, this is normally part of any image viewer worth its salt.
-
\$\begingroup\$ The last 3 digits may be milliseconds (which usually are not displayed in EXIF data) \$\endgroup\$ Commented Jan 15, 2019 at 17:30
-
\$\begingroup\$ Yes, but then I expect them to be
918
and not856
. \$\endgroup\$– xenoidCommented Jan 15, 2019 at 19:04 -
\$\begingroup\$ 918 is digitized time, not created :) (just joke and speculation) \$\endgroup\$ Commented Jan 15, 2019 at 19:06
The original filename is not stored in Exif. However, Exif data may be used to reconstruct the filename. For instance, some devices name files according to date/time.
Also, some cameras store a frame number from which the filename can be guessed if filename numbering was set to continuous. If filename numbering was set to reset, the filename may be recoverable by examination of the filesystem journal, but that is way outside the scope of photography.SE.
-
1\$\begingroup\$ Nor is the filename in the thumbnail buried in the JPG, at least not for the examples I checked. \$\endgroup\$ Commented Jan 17, 2019 at 17:16
Building on xiota's answer, most Nikon cameras store a file sequence number in the EXIF data which matches the original filename.
What you'll find in the EXIF is something called Image Number. In this case it's 4002.
The original file name was AK5_4002.nef (my initials, 5 for D5). Reconstructing the original file names is relatively easy using either ExifTool on the command line or something like Better Finder Rename on macOS or its Windows equivalent. Linux crowd will probably use ExifTool directly.
In my case, I had a bunch of badly renamed files, which didn't match for moving full IPTC data from a finished metadata set to a corrected set of metadata. Without matching file names, I thought I was in a lot of trouble, trying to move metadata from one set to the other. In the end I found a simpler workaround than going back to the original filenames. I could rename all the files by yearmonthday-hourminutesecond. This put the files I needed beside one another. This would give some issues though as it's impossible to keep identically named files in the same folder.
I then simplified further and put the files in a single folder named as they were, opened the folder in my photo management application (PhotoMechanic) and sorted by capture date. This meant I could go through the matching photos, which were right next to one another now, moving the missing IPTC data one by one with simple PhotoMechanic metadata copy and paste.
I include my problem which caused me to wish to go back to the original filename and the workaround I found, as an example of creative thinking which would work for all cameras even if the original filename isn't there. As a sports photographer, I spend far too much time with photo metadata.
Examine the Exif data for the file. The original filename (or a counter or something) may be stored in there. If I recall correctly, I did this with success years ago with JPG files that had come from my Canon PowerShot A70 camera.