If EXIF metadata is removed, can I find the software or camera used in any other way?

Question

I have a JPEG photo that has had its EXIF data completely removed. I know the photo was edited. Is there any data left in the altered JPEG that points to image editors or equipment used? For example, does Adobe Photoshop have a particular string ID it places in JPEG code other than in the EXIF metadata? Like a footprint in snow.

Answer 1

JPEGsnoop compares the compression signature in a JPEG with its database of known combinations of signatures and software/firmware, and gives a list of software/cameras that match the signature of the input image. Here is some sample output:

*** Searching Compression Signatures ***

  Signature:           013BA18D5561625796E986FDBC09F846
  Signature (Rotated): 01AC57E12793DFA7C46C704625C5AF0F
  File Offset:         0 bytes
  Chroma subsampling:  2x2
  EXIF Make/Model:     NONE
  EXIF Makernotes:     NONE
  EXIF Software:       NONE

  Searching Compression Signatures: (3347 built-in, 0 user(*) )

          EXIF.Make / Software        EXIF.Model                            Quality           Subsamp Match?
          -------------------------   -----------------------------------   ----------------  --------------
     CAM:[???                      ] [Treo 680                           ] [                ] Yes              
     CAM:[Canon                    ] [Canon PowerShot Pro1               ] [fine            ] No               
     CAM:[NIKON                    ] [E2500                              ] [FINE            ] No               
     CAM:[NIKON                    ] [E3100                              ] [FINE            ] No               
     CAM:[NIKON                    ] [E4500                              ] [FINE            ] No               
     CAM:[NIKON                    ] [E5000                              ] [FINE            ] No               
     CAM:[NIKON                    ] [E5700                              ] [FINE            ] No               
     CAM:[NIKON                    ] [E775                               ] [FINE            ] No               
     CAM:[NIKON                    ] [E885                               ] [FINE            ] No               
     CAM:[OLYMPUS OPTICAL CO.,LTD  ] [C3040Z                             ] [                ] No               
     CAM:[PENTAX                   ] [PENTAX Optio 550                   ] [                ] No               
     CAM:[Research In Motion       ] [BlackBerry 9530                    ] [Superfine       ] Yes              
     CAM:[SEIKO EPSON CORP.        ] [PhotoPC 3000Z                      ] [                ] No               
     CAM:[SONY                     ] [DSC-H7                             ] [                ] No               
     CAM:[SONY                     ] [DSC-H9                             ] [                ] No               
     CAM:[SONY                     ] [DSC-S90                            ] [                ] No               
     CAM:[SONY                     ] [DSC-W1                             ] [                ] No               
     CAM:[SONY                     ] [SONY                               ] [                ] No               
     SW :[ACDSee                   ]                                       [                ]                  
     SW :[FixFoto                  ]                                       [fine            ]                  
     SW :[IJG Library              ]                                       [090             ]                  
     SW :[ZoomBrowser EX           ]                                       [high            ]                  

    The following IJG-based editors also match this signature:
     SW :[GIMP                     ]                                       [090             ]                  
     SW :[IrfanView                ]                                       [090             ]                  
     SW :[idImager                 ]                                       [090             ]                  
     SW :[FastStone Image Viewer   ]                                       [090             ]                  
     SW :[NeatImage                ]                                       [090             ]                  
     SW :[Paint.NET                ]                                       [090             ]                  
     SW :[Photomatix               ]                                       [090             ]                  
     SW :[XnView                   ]                                       [090             ]                  

  Based on the analysis of compression characteristics and EXIF metadata:

  ASSESSMENT: Class 1 - Image is processed/edited

  This may be a new software editor for the database.
  If this file is processed, and editor doesn't appear in list above,
  PLEASE ADD TO DATABASE with [Tools->Add Camera to DB]

Answer 2

There are multiple sections of metadata in a JPEG files but they can all be removed. Software which strips EXIF can strip it to various degrees but can also remove all other metadata sections. This is often done when posting on the internet to avoid personal information leaking such as geolocation or to make files lighter for upload.

In any case, you cannot be sure a JPEG file camera from a camera at all unless there is metadata to indicate the contrary. Imagine a user doing File -> New in Photoshop or any other imaging software. At that point they have an new file without any data relating to the camera but they can still cut-and-paste pixels from an image which has metadata. An image created this way can indicate which software is used but nothing about the camera.

Also cameras can often shoot in RAW, DNG or TIFF. In that case a conversion program is used to create a JPEG from it and that converter may not leave any metadata in the output, depending on options used. In the case of RAW and DNG, those are not even image formats so when converted to an image the data has to be transformed and pixels are interpolated, so you would get an image but not necessarily one that people would consider edited.

Answer 3

TL;DR - Theoretically, yes. Realistically, probably not.

Longer version: Theoretically, it should be possible to determine the app, or at least library used by the app, that made an image in many cases. Applications and libraries often write data in a specific order or a specific way, and this can sometimes be determined by examining the image data. However, this information is generally not publicly available and would require quite a bit of knowledge of different libraries and applications to figure out. It's the type of thing a forensic analyst might be able to do, but would probably be hard for an individual.

One thing you can try to do is open the image in a hex editor. If you're on a Mac or Linux, you can go to the command-line and type:

xxd <path/to/file>

That will display the contents of the file in hexadecimal and ASCII and may reveal things such as strings with the application or library name. If you're a programmer, you could always get the spec for JPEG format and manually parse through the data in the file after making a hex dump and see if it reveals anything useful. I don't have any specific knowledge of information you could look for beyond strings with the word Photoshop in them, or perhaps "8BIM" which is the old macOS 4-character type identifier for the application.