Photography Stack Exchange is a question and answer site for professional, enthusiast and amateur photographers. It only takes a minute to sign up.
Sign up to join this community
There was a photography contest and it was limited to only three days of shooting - but the winning photo seemed a little out of season.
So I suspect that the winner changed the metadata on the photo. Is there any way to detect if any changes have been made to metadata? Or any way to roll back to the original data?
It is sadly impossible to to prove when an image (or any file for that matter) originated. It is possible (if the author wants to) to prove that a file existed prior to a given time by signing the file from a third party time stamping server (through which the third party proves that the file existed at the time of the signing) but such information is not automatically possible and can easily be stripped.
I am also an IT Security guy and there is no possible secure way to prove the creation date of any file if the user controls the system creating the file with current technology that I am aware of. The best bet would be a device with a locked clock that would have a hidden key store that the user shouldn't have access to and create a signature based on this so that they couldn't fake their own signature, but since the key must still reside in the device, it is still feasibly possible for someone to break as all the necessary information is in their possession, even if it is hard to get to.
As far as detecting an amateur job, there is generally a file creation date in meta data of the file system itself that could be examined and compared to the EXIF metadata, but if they are good at it, they will have altered both and there is some possibility of the file system values getting lost depending on how the file is transferred, so it may not even be reliable.
If it's done well, absolutely impossible to detect (it's just bits in a file). If it's done crudely, there may well be some tell-tale signs... but my personal guess would be that it hasn't been tampered with at all and it's just a good photographer.
After the fact it is pretty hard to tell unless the image has been posted somewhere else with a different time stamp or something along those lines. Keep in mind that it's pretty much always spring/summer/fall/winter somewhere and if they're global they may have legitimately taken that image (or altered it to look that way, depending on what your editing policy is for that contest).
For anyone looking to prove their case should they find themselves being suspect of tampering, Canon has a custom function on some cameras to "add image verification data" which basically signs each image. Now, this won't prevent someone from changing the time on the camera prior to taking the picture, but it shows if the image has been edited afterwards. This is not meant for creative types, but for things that will be used as evidence in court and the like.
If the only modification in the image file is related to the EXIF DateTime field, that can be changed easily without leaving any trace. It is possible to verify incompatibilities at files system level: ideally the EXIF DateTime should match with the Last Modification time set by the operating system, but this can be different for legit reasons, like a file copy, and in any case it can be simply overwritten by proper tools.
If you think that also some other modification occurred at pixel level, that is usually identified by the proper techniques. You can see some examples of analysis with a specialized tool for image forensics like Amped Authenticate (http://ampedsoftware.com/authenticate-samples - DISCLAIMER: I am the company founder).
