Suspect photograph timestamp data has been altered

Question

I received photographs over email from a client which I suspect were taken in 2022 but the client insists are from 2021.

I looked at the metadata, filenames, and date modified timestamps to look for any inconsistencies but they all check out with the client's story. For example, the "date taken" and "date modified" field are all from around the right time and the filenames are ordered sequentially (IMG_0419.jpg, IMG_420.jpg, etc.) in the same order as the date taken timestamps, as you would expect if they were legitimate.

I'm wondering if if there's anything else I should take a look at or if those timestamps could have been altered. I searched and see there are tools that can do this (Attribute changer).

For example,

• Is it possible there is other timestamped information in the file that I'm missing besides those two fields?
• Should the date modified and the date taken fields be exactly the same down to the second? I noticed there are a few seconds difference in these values in each photo, which indicates to me it may have been altered (unless this is normal, I'm not sure).
• Is there other metadata that could somehow help me determine when the photo was taken? As an example, I noticed the metadata says that they were taken on an iPhone 12 pro, which obviously puts a bound on the earliest they could have been taken (the release date of that phone, October 23, 2020).

What else should I be looking for?

Answer 1

Not an expert in iPhone EXIF data, but a few things to check:

GPS time and other attributes

In my camera, if the picture has GPS coordinates, it also has a GPS time stamp (than can differ slightly from the other EXIF timestamps, if the camera isn't kept on GPS time). In fact it has a many GPS tags:

GPS Latitude Ref                : North
GPS Longitude Ref               : East
GPS Altitude Ref                : Above Sea Level
GPS Time Stamp                  : 19:02:26
GPS Processing Method           : GPS
GPS Date Stamp                  : 2019:08:19
GPS Altitude                    : 304.7 m Above Sea Level
GPS Date/Time                   : 2019:08:19 19:02:26Z
GPS Latitude                    : 48 deg 8' 23.60" N
GPS Longitude                   : 7 deg 15' 37.54" E
GPS Position                    : 48 deg 8' 23.60" N, 7 deg 15' 37.54" E

These tags are often ripped out by phone apps when transmitting the file. If you only have a couple of position tags, this could mean they have been added later. You can also find an iPhone 12 and find what GP tags it actually produces.

Camera serial number

In pictures from my old Motorola, there is a Serial number (which alone could help tracking its sell date/manufacture date) and even a Manufacture date. So these could indicate a camera more recent than the pictures...

Software version

Pictures from my more recent Android phone carry a Software tag that identifies the OS release in my camera (but it could be the camera app in other phones). Since smartphones receive automatic updates, even old phones would have a recent software version, and this pushes forward the earliest time a picture could have been taken by the camera (if it was overlooked by people altering EXIF data, of course). This will even define a time bracket (the picture must have been taken between the update that installed that version and the update that installed the next). In my smartphone, I have 4 different software releases for 2019 alone...

Answer 2

All photo metadata can be falsified by someone who really wants to do it. Standards like C2PA are working to fix this, but it will be a long time before all devices use their standards to put signed signatures on all image files.

Regarding the date modified and date created fields, it's quite possible that they are different. One could say that them being slightly different is a sign that the metadata is not fake, because if you were writing a fake date/time into each field you would probably set the same values everywhere.

Of course, the pixels can be falsified too. It's sometimes possible to detect whether pixels have been altered using online tools - but none of these tools is perfect.

exiftool is your best bet for viewing all image metadata (Exif, IPTC, custom camera tags).

Answer 3

I do not think there is anything which can give you a clue about the precise time and date photo was taken. All this information can be altered post factum w/o any trace.

There is one thing which can eventually help and which usually is out of sign of cheaters: GPS coordinates. Check if meta information of photo have GPS coordinates and map them so see if this is expected place. And the date and time, bind to GPS data.