How can I prove an edited photo was taken on a particular date/time?

Question

Please help explain this.

I have a photo that has the filename containing the date taken. It looks like this when a photo is taken. Does an iPhone or Android automatically name the file with the date taken in it? I also need someone to confirm the the original file date taken that includes the camera maker, ISO, flash, etc., is attached to the original photo.

My problem is, some photos were added into Google Drive and Google Photos. When making a copy, it changed the date and I must have done some photo edits and created some shadowing. This shadowing and date changes make it appear as if it a different photo.

You see the issue is this: the original was taken by boyfriend but since dates changed and shadowing occurred, he is now convinced this photo was taken another time, and that the shadowing is two men on my couch. Our photo was taken with me in a particular outfit. Now he is convinced I was showing the outfit off to two imaginary men on our couch. Even the actual photo appears the same as the original, except for dates and the "shadow men". He is still convinced I'm lying.

Can someone please explain meta date/time file and the difference in modified, created, and date taken. It's hard for me to explain, and he is convinced I'm lying. I have tried to explain that when the photo is taken it creates the file information that doesn't change, but it appears it can be. I have the original photo and it shows date and time and camera info. In fact the JPG filename also contains the date/time.

Please help and explain it as elementary as you can as he and I are not very technical or photographers. This has destroyed a relationship and I'm so tired of being called a liar. The file name looks like IMG_20170117_184947.jpg. Please explain or show how this happens and a way to confirm the edited photo is simply the original and the edits are not what he thinks.

Answer 1

Simple answer: you can't prove anything. A (digital) photo is just a sequence of ones and zeros (bits) on a disk somewhere, and anyone with enough time, money and dedication could get those bits to say anything they wanted.

Answer 2

You can't really prove the date, but you can prove the photo is identical to the original photo, except for the shadowing. Quickly flip between those two photos and it would be obvious that not a slightest detail changes. Anyone trusting the original photo must admit it would not be possible to take another photo using exactly the same pose and exactly the same objects around you in the same positions.

Answer 3

Any method for demonstrating that the edited photo came from a particular original, or that the original was taken at a particular time or date, must be predicated on the evaluator being a rational person. Therefore, the first and perhaps only necessary step here is to find a new boyfriend.

That said, there's usually a lot more metadata connected to an image file than just the filename. The standard format for image metadata is called EXIF, and there are plenty of tools out there for viewing that data. Most image editors will show you at least some of that information, and tools like ExifTool and ImageMagik can list all the EXIF metadata. To use ImageMagik, for example, you'd first make sure that it's installed and then use the identify command like this:

identify -format '%[EXIF:*]' yourfilename.jpg

to dump all the metadata. If you just want the original date of the image, you can get that with:

identify -format '%[EXIF:DateTimeOriginal*]' yourfilename.jpg

and that'd give you output like:

exif:DateTimeOriginal=2015:04:28 12:32:23

Answer 4

You can actually provide several hints toward authenticity of date of creation.

You have several timestamps:

• creation of file
• modification of file, and
• last read of file, but also a timestamp of
• creation of image in its EXIF metadata (data that is not image but that comes along with the image, and all of these are parts of the file), and eventually an
• IPTC creation of image timestamp (another metadata).

Those file timestamps (the 3 first ones) might differ from OS to the other (windows, linux, BSD, MacOS, etc) when there was a volontary change (eg., with touch), but metadata should remain untouched, if persistent.

When you copy your file, modification date is updated, but creation time of file and creation date in EXIF should match. There are methods to change creation date but, if we suppose it was not changed, there should be convergence (they are identical, even the second stamp) between creation date (as file) and creation date (in EXIF), this is the date when the image was made, and it should be the earliest date.

Unfortunately, if you store files in the cloud (google drive, etc), usually EXIF data is removed for privacy, and when you download your images, dates of creation and modification are matching the moment you downloaded your files.

Hence, if you have several images (with the same content) with several time stamps, you can retrieve their history through their time stamps.

Another track is to scan a drive (hard drive, memory card) to undelete files. You can, thanks to that, find eventually older, or at least deleted version of a certain file. If there is a match, you go toward authenticity.

With magnetic hysteresis, (valid for hard drives), you can retrieve data even after delete/rewrite/format. But this is usually outside of reach of the usual consumer.

Even if files are just bits and technically can be spoofed, they have a value (equal to printed version) for Department of justice, as well as emails.

Answer 5

This has destroyed a relationship and I'm so tired of being called a liar.

Well, there is this joke about two people walking a street and someone else comes around the corner, changes color and crosses to the other side of the road while one of the two frowns at him. "What's up with that?" "I lent him $20 and he never paid me back and avoids talking to me." "Do you like him?" "I hate his guts." "Sounds like a good investment to me."

To get back to the photographic part of your question: given sufficient criminal energy and skills, any bit about a digital photograph may be forged. It's a matter of the forger having skills and resources matching the person verifying the authenticity.

This silliness is arbitrary. Your purported boyfriend does not trust your word, and there will be more than enough occasions in a relationship where your word is the only thing that counts. As others said: this is "Interpersonal Relations", not photography. And my advice is to embrace this having been able to blow up your "relationship" and move on.