Mobile Forensics · Where the Evidence Lives · Lesson 3 of 5

Photos & EXIF

Read the hidden details inside a photo, and learn when not to trust them.

What a photo knows about itself

When a phone takes a picture, it saves more than the image. It also writes metadata, which means data about the data. For photos, the main standard is EXIF (Exchangeable image file format), published by the Japanese camera industry group CIPA together with JEITA. EXIF fields are stored inside the photo file itself.

A few fields matter most to an examiner:

• DateTimeOriginal: when the picture was taken, written like 2026:05:14 16:42:09. It's local clock time, with no time zone attached.
• OffsetTimeOriginal: how far that local time was from UTC (Coordinated Universal Time, the world's reference clock), written like -04:00. These offset fields were added in Exif 2.31 in 2016, so older cameras and some apps don't fill them in.
• Make and Model: the manufacturer and model of the camera or phone.
• GPS fields: latitude, longitude and often altitude, recorded only if location was allowed for the camera. The standard also has a GPS time stamp, which is always in UTC.

Put the first two together and you get an exact moment. A photo taken at 09:15 with an offset of -05:00 was taken where clocks run five hours behind UTC, so the UTC time was 14:15. A positive offset works the other way: subtract it. That's how an examiner lines up photos with records from other sources, like call logs, that may be stored in UTC.

EXIF is often more reliable than the file's own file system timestamps, the created and modified times the storage system keeps for every file. Those can change when a file is copied, downloaded or restored from a backup. EXIF travels inside the file, so it usually survives a copy.

On the simulated phone, open the details for both copies of IMG_2041. Compare what's left in the copy received through a messaging app, then use the original's offset to work out the time.

Stripped, shared and edited

In the lab, the copy received through a messaging app had lost almost everything. That's common. Many messaging and social apps shrink photos to save data and strip most metadata, partly for privacy, since GPS coordinates can reveal where someone lives. Exactly what's removed varies by app, by setting (some apps keep more when you send a picture as a file), and it can change with updates. An examiner never assumes. They check what that specific copy contains.

The practical lesson is that the original matters. If the question is where and when a photo was taken, the best source is usually the copy in the camera roll of the phone that took it, not a copy that passed through an app.

Users can also control this themselves. On an iPhone, Apple's support guide describes sharing a photo without its location: in the share sheet, tap Options and turn off Location, and the sheet shows Location Not Included. Photos also lets you remove or change a photo's location using Adjust Location. So a photo with no GPS may simply mean the owner chose not to share it.

That leads to the most important rule about metadata. It can be edited. Free apps and photo software can change the date, the camera model or the GPS position, and the result can look completely normal. Even honest metadata can be wrong. A phone with the wrong clock setting writes the wrong time.

So EXIF is treated as a lead to corroborate, meaning confirm with independent evidence, rather than a fact to trust on its own. Does the photo's time fit the phone's other records? Does the GPS match location data from the same moment? Does the photo's database record on the phone agree with the file? When several sources line up, the conclusion is much stronger.