18
\$\begingroup\$

There was a photography contest and it was limited to only three days of shooting - but the winning photo seemed a little out of season.

So I suspect that the winner changed the metadata on the photo. Is there any way to detect if any changes have been made to metadata? Or any way to roll back to the original data?

\$\endgroup\$
7
  • 1
    \$\begingroup\$ take a look at this site to see how easy it is to change the exif date: askubuntu.com/questions/101688/… \$\endgroup\$ Oct 4, 2013 at 15:38
  • \$\begingroup\$ Even if there was some way to help I doubt it would apply to JPEGs, and every raw format (Canon/Nikon etc.) in the world. \$\endgroup\$
    – dcaswell
    Oct 6, 2013 at 18:29
  • \$\begingroup\$ @kursat I'm not sure what you're hoping to get from the bounty here - you've got the answer, which is a pretty clear "no". A Stack Exchange bounty won't change that. \$\endgroup\$
    – Philip Kendall
    Oct 7, 2013 at 8:28
  • 1
    \$\begingroup\$ Keep in mind that "out of season" could be achieved by being in a different location. It is summer in Argentina while it's winter in the US, for example. Elevation and percipitation changes can allow access to different climates for relatively small travel distances. \$\endgroup\$ Oct 8, 2013 at 16:06
  • 3
    \$\begingroup\$ Ultimately someone doesn't need to change their EXIF data to do this. They can just change the date in their camera, take a picture, and change the date back. \$\endgroup\$
    – dcaswell
    Oct 8, 2013 at 23:11

4 Answers 4

13
+50
\$\begingroup\$

It is sadly impossible to to prove when an image (or any file for that matter) originated. It is possible (if the author wants to) to prove that a file existed prior to a given time by signing the file from a third party time stamping server (through which the third party proves that the file existed at the time of the signing) but such information is not automatically possible and can easily be stripped.

I am also an IT Security guy and there is no possible secure way to prove the creation date of any file if the user controls the system creating the file with current technology that I am aware of. The best bet would be a device with a locked clock that would have a hidden key store that the user shouldn't have access to and create a signature based on this so that they couldn't fake their own signature, but since the key must still reside in the device, it is still feasibly possible for someone to break as all the necessary information is in their possession, even if it is hard to get to.

As far as detecting an amateur job, there is generally a file creation date in meta data of the file system itself that could be examined and compared to the EXIF metadata, but if they are good at it, they will have altered both and there is some possibility of the file system values getting lost depending on how the file is transferred, so it may not even be reliable.

\$\endgroup\$
1
\$\begingroup\$

If it's done well, absolutely impossible to detect (it's just bits in a file). If it's done crudely, there may well be some tell-tale signs... but my personal guess would be that it hasn't been tampered with at all and it's just a good photographer.

\$\endgroup\$
1
\$\begingroup\$

After the fact it is pretty hard to tell unless the image has been posted somewhere else with a different time stamp or something along those lines. Keep in mind that it's pretty much always spring/summer/fall/winter somewhere and if they're global they may have legitimately taken that image (or altered it to look that way, depending on what your editing policy is for that contest).

For anyone looking to prove their case should they find themselves being suspect of tampering, Canon has a custom function on some cameras to "add image verification data" which basically signs each image. Now, this won't prevent someone from changing the time on the camera prior to taking the picture, but it shows if the image has been edited afterwards. This is not meant for creative types, but for things that will be used as evidence in court and the like.

\$\endgroup\$
2
  • 5
    \$\begingroup\$ Canon's custom verification was broken years ago. Tools exist to reset the verification after a file has been modified. \$\endgroup\$ Oct 9, 2013 at 14:35
  • 1
    \$\begingroup\$ Interesting; I was unaware of that, though I can't say I'm surprised. \$\endgroup\$
    – tenmiles
    Oct 9, 2013 at 15:11
1
\$\begingroup\$

If the only modification in the image file is related to the EXIF DateTime field, that can be changed easily without leaving any trace. It is possible to verify incompatibilities at files system level: ideally the EXIF DateTime should match with the Last Modification time set by the operating system, but this can be different for legit reasons, like a file copy, and in any case it can be simply overwritten by proper tools.

If you think that also some other modification occurred at pixel level, that is usually identified by the proper techniques. You can see some examples of analysis with a specialized tool for image forensics like Amped Authenticate (http://ampedsoftware.com/authenticate-samples - DISCLAIMER: I am the company founder).

\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.