6

I have a JPEG photo that has had its EXIF data completely removed. I know the photo was edited. Is there any data left in the altered JPEG that points to image editors or equipment used? For example, does Adobe Photoshop have a particular string ID it places in JPEG code other than in the EXIF metadata? Like a footprint in snow.

  • 4
    Not even the EXIF data is necessarily true. It can be spoofed to give a false camera ID, editing application, etc. – Michael C Nov 17 '16 at 17:28
  • Thanks for answering back. I assume then no footprint, right, or should I contact Adobe to see if they could examine the photo to verify or tell me what to look for. I understand IT/software security and I am asking something in a gray area... Thanks again. Hiram Brock – user657491 Nov 17 '16 at 17:57
  • Try running the image through regex.info/exif.cgi -- there are many kinds of metadata that could be in there. This tool should reveal it. – Drew Noakes Nov 17 '16 at 21:08
  • Thanks Drew, tried it, sorry no luck. Looks like I'm gonna be diggen through code. Deep rabbit hole I'm getting myself into... – user657491 Nov 17 '16 at 21:41
  • 1
    Even if you know the tool, you still don't know how it was used. – null Nov 17 '16 at 21:57
8

JPEGsnoop compares the compression signature in a JPEG with its database of known combinations of signatures and software/firmware, and gives a list of software/cameras that match the signature of the input image. Here is some sample output:

*** Searching Compression Signatures ***

  Signature:           013BA18D5561625796E986FDBC09F846
  Signature (Rotated): 01AC57E12793DFA7C46C704625C5AF0F
  File Offset:         0 bytes
  Chroma subsampling:  2x2
  EXIF Make/Model:     NONE
  EXIF Makernotes:     NONE
  EXIF Software:       NONE

  Searching Compression Signatures: (3347 built-in, 0 user(*) )

          EXIF.Make / Software        EXIF.Model                            Quality           Subsamp Match?
          -------------------------   -----------------------------------   ----------------  --------------
     CAM:[???                      ] [Treo 680                           ] [                ] Yes              
     CAM:[Canon                    ] [Canon PowerShot Pro1               ] [fine            ] No               
     CAM:[NIKON                    ] [E2500                              ] [FINE            ] No               
     CAM:[NIKON                    ] [E3100                              ] [FINE            ] No               
     CAM:[NIKON                    ] [E4500                              ] [FINE            ] No               
     CAM:[NIKON                    ] [E5000                              ] [FINE            ] No               
     CAM:[NIKON                    ] [E5700                              ] [FINE            ] No               
     CAM:[NIKON                    ] [E775                               ] [FINE            ] No               
     CAM:[NIKON                    ] [E885                               ] [FINE            ] No               
     CAM:[OLYMPUS OPTICAL CO.,LTD  ] [C3040Z                             ] [                ] No               
     CAM:[PENTAX                   ] [PENTAX Optio 550                   ] [                ] No               
     CAM:[Research In Motion       ] [BlackBerry 9530                    ] [Superfine       ] Yes              
     CAM:[SEIKO EPSON CORP.        ] [PhotoPC 3000Z                      ] [                ] No               
     CAM:[SONY                     ] [DSC-H7                             ] [                ] No               
     CAM:[SONY                     ] [DSC-H9                             ] [                ] No               
     CAM:[SONY                     ] [DSC-S90                            ] [                ] No               
     CAM:[SONY                     ] [DSC-W1                             ] [                ] No               
     CAM:[SONY                     ] [SONY                               ] [                ] No               
     SW :[ACDSee                   ]                                       [                ]                  
     SW :[FixFoto                  ]                                       [fine            ]                  
     SW :[IJG Library              ]                                       [090             ]                  
     SW :[ZoomBrowser EX           ]                                       [high            ]                  

    The following IJG-based editors also match this signature:
     SW :[GIMP                     ]                                       [090             ]                  
     SW :[IrfanView                ]                                       [090             ]                  
     SW :[idImager                 ]                                       [090             ]                  
     SW :[FastStone Image Viewer   ]                                       [090             ]                  
     SW :[NeatImage                ]                                       [090             ]                  
     SW :[Paint.NET                ]                                       [090             ]                  
     SW :[Photomatix               ]                                       [090             ]                  
     SW :[XnView                   ]                                       [090             ]                  

  Based on the analysis of compression characteristics and EXIF metadata:

  ASSESSMENT: Class 1 - Image is processed/edited

  This may be a new software editor for the database.
  If this file is processed, and editor doesn't appear in list above,
  PLEASE ADD TO DATABASE with [Tools->Add Camera to DB]
2

There are multiple sections of metadata in a JPEG files but they can all be removed. Software which strips EXIF can strip it to various degrees but can also remove all other metadata sections. This is often done when posting on the internet to avoid personal information leaking such as geolocation or to make files lighter for upload.

In any case, you cannot be sure a JPEG file camera from a camera at all unless there is metadata to indicate the contrary. Imagine a user doing File -> New in Photoshop or any other imaging software. At that point they have an new file without any data relating to the camera but they can still cut-and-paste pixels from an image which has metadata. An image created this way can indicate which software is used but nothing about the camera.

Also cameras can often shoot in RAW, DNG or TIFF. In that case a conversion program is used to create a JPEG from it and that converter may not leave any metadata in the output, depending on options used. In the case of RAW and DNG, those are not even image formats so when converted to an image the data has to be transformed and pixels are interpolated, so you would get an image but not necessarily one that people would consider edited.

  • ltai, Btw, I did include you in the above comment to user 118321, thought it prudent to give EVERYONE a big thanks. – user657491 Nov 17 '16 at 22:38
1

TL;DR - Theoretically, yes. Realistically, probably not.

Longer version: Theoretically, it should be possible to determine the app, or at least library used by the app, that made an image in many cases. Applications and libraries often write data in a specific order or a specific way, and this can sometimes be determined by examining the image data. However, this information is generally not publicly available and would require quite a bit of knowledge of different libraries and applications to figure out. It's the type of thing a forensic analyst might be able to do, but would probably be hard for an individual.

One thing you can try to do is open the image in a hex editor. If you're on a Mac or Linux, you can go to the command-line and type:

xxd <path/to/file>

That will display the contents of the file in hexadecimal and ASCII and may reveal things such as strings with the application or library name. If you're a programmer, you could always get the spec for JPEG format and manually parse through the data in the file after making a hex dump and see if it reveals anything useful. I don't have any specific knowledge of information you could look for beyond strings with the word Photoshop in them, or perhaps "8BIM" which is the old macOS 4-character type identifier for the application.

  • Thank You All so much for you advice and insight. I now have some direction to follow and an idea of what to look for and maybe, if I ask the right questions to image editing companies I may get the information I need. One thing absolute, I'm gonna have to dust off many brain cells and reach back to my college years when now I wish I had been more attentive to CS profs. Again, Thanks to All. – user657491 Nov 17 '16 at 21:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.