EXIF Information that helps to detect doctored image

Question

What EXIF information would be a good indication to know if an image has been doctored or not, and why is that information helpful? I think one of them is the aperture.

Answer 1

For straight out-of-camera JPEGs, you may want to expand the metadata & data review to include things like the Quantization Table Matrix, Chroma Subsampling, and Huffman Tables, all of which help to describe how the JPEG is encoded. For example a lot of cameras use 2x1 Chroma Subsampling, while Photoshop may use 2x2 Chroma Subsampling. In regard to JPEG decoding, JPEGSnoop is the only tool, that I know of, that examines and reports the various matrices and tables.

In some cases, attributes of a particular camera, such as the consistent location of hot pixels can be used to compare images for authenticity.

In regard to typical metadata, I find that it's not what is changed for a particular metadata field that is tell-tale, but what new metadata is added or what metadata is missing that should be there. Almost every photo editing software package (at least, that I know) adds new fields, frequently some form of XML. In some cases, e.g. MS Windows, metadata is mangled or removed. I find "EXIFTool -csv ..." to be very useful.

Combining all of the aforementioned items; JPEG encoding, specific camera attributes, an inventory of all the metadata, can give you some degree of confidence that a JPEG image is directly from the camera. Of course, a clever determined person could game all of that, but it takes a lot of careful work.

Answer 2

Frankly, not much. The specifics will depend a lot on what you mean by "doctored" - if you're looking at the cloning out of a small object from the scene, I very much doubt you're going to get anything from the EXIF which would give you much of a clue that had happened. Obviously, for gross manipulations like compositing two images together you're going to be able to get some idea from the EXIF that something funny has happened - but you're probably going to get that from the image anyway.

There's also of course the age-old debate about what you mean by "doctored" anyway - looking particularly at your example of aperture, is applying an in-camera "background blur" effect "doctoring" the image? What if I do it in post-process?

Answer 3

There are three EXIF fields for the Date/Time the file was last saved (DateTime), the Date/Time the original data was created (DateTimeOriginal), and the Date/Time the file was digitized (DateTimeDigitized) that might be helpful in determining if an image was "doctored", however, EXIF information can also be edited or stripped from a file, so it's no reliable guide.

Also bear in mind that to a great many of us, post-processing an image is not the same as "doctoring" it.

As for why EXIF metadata is helpful, it's an easy way to note what settings/equipment were used to take a shot without having to actually notate this yourself while you are shooting. It can be very useful in analyzing how/why a shot went wrong or worked a specific way after the fact. If the EXIF information hasn't been tampered with.

For an explanation of EXIF fields, you may want to peruse the standard.

Answer 4

There is a tag called "Software". I'm not 100% sure what it refers to when it's straight out of camera, possibly the firmware version of the camera or processing software that it uses?

Below are examples of photos with exactly the same EXIF data, except for the Software tag. As you can see, they are visually different because it has been edited in "Adobe Photoshop Lightroom v4.4".

Without having an image to compare to, there isn't too much to go by. There are also programs such as ExifTool that allows you to edit the EXIF data anyway.

Answer 5

One slightly difficult to fake part of the EXIF metadata are the maker notes. This is a section whose content is not standardized, each camera manufacturer will write its own, proprietary data in it and as a consequence, it often gets stripped away by image editing software, or copied verbatim.

I.e., it is not updateabe by the user (not easily) and any discrepancies to the standardized data or the lack of that section are an indicator of post processing.