Exchangeable Image File Format (EXIF) is a standard for storing information (or metadata) with an digital image, generally one from a digital camera.  EXIF can contain valuable information about an image, in some cases it will even store the GPS coordinates of where the picture was taken.

Concerns over verifiability of EXIF data

While EXIF data can be extremely useful, a forensic analysts must not assume this data is accurate.  This information can be easily manipulated or modified.  For instance, the time on the camera can be easily changed.  Or the GPS device may be inaccurate.  Also, there are widely available programs which will allow you to view and update the EXIF information.  In the easly  iPhone 2.x releases, the GPS data (also known as a geotag, geocode or geolocation) was missing the degree of seconds, making it impossible to point point the exact location.

Sample output

For reference, the following is the EXIF information recovered from a .jpg that was carved from a file system:

FileType = JPEG
FileSize = 145653
JPEG.APP0           = @2:16
JPEG.APP0.Version       = 1.1
JPEG.APP0.Units         = ‘dots/inch’
JPEG.APP0.Xdensity      = 96
JPEG.APP0.Ydensity      = 96
JPEG.APP0.XThumbnail    = 0
JPEG.APP0.YThumbnail    = 0
JPEG.APP1           = @20:10454
JPEG.APP1.Ifd0.Make                        = ‘Canon’
JPEG.APP1.Ifd0.Model                       = ‘Canon PowerShot SD900′
JPEG.APP1.Ifd0.Orientation                 = 1 = ‘0,0 is top left’
JPEG.APP1.Ifd0.XResolution                 = 180
JPEG.APP1.Ifd0.YResolution                 = 180
JPEG.APP1.Ifd0.ResolutionUnit              = 2 = ‘pixels per inch’
JPEG.APP1.Ifd0.DateTime                    = ‘2008:05:31 09:42:15′
JPEG.APP1.Ifd0.YCbCrPositioning            = 1 = ‘centered’
JPEG.APP1.Ifd0.TAG_0×1001                  = 3648
JPEG.APP1.Ifd0.TAG_0×1002                  = 2736
JPEG.APP1.Ifd0.ExifIFDPointer              = @308
JPEG.APP1.Ifd0.CustomRendered              = 0 = ‘Normal’
JPEG.APP1.Ifd0.ExposureMode                = 0 = ‘Auto’
JPEG.APP1.Ifd0.WhiteBalance                = 0 = ‘Auto’
JPEG.APP1.Ifd0.DigitalZoomRatio            = 1
JPEG.APP1.Ifd0.SceneCaptureType            = 0 = ‘Standard’
JPEG.APP1.Ifd0.Exif.ExposureTime                = 0.00625 sec
JPEG.APP1.Ifd0.Exif.FNumber                     = 8 APEX = ‘f16.0′
JPEG.APP1.Ifd0.Exif.Version                     = ‘0220′
JPEG.APP1.Ifd0.Exif.DateTimeOriginal            = ‘2008:05:31 09:42:15′
JPEG.APP1.Ifd0.Exif.DateTimeDigitized           = ‘2008:05:31 09:42:15′
JPEG.APP1.Ifd0.Exif.ComponentsConfiguration     = 1,2,3,0 = ‘YCbCr’
JPEG.APP1.Ifd0.Exif.CompressedBitsPerPixel      = 5
JPEG.APP1.Ifd0.Exif.ShutterSpeedValue           = 7.3125 APEX = ‘0.00629098 sec’JPEG.APP1.Ifd0.Exif.ApertureValue               = 6 APEX = ‘f8.0′
JPEG.APP1.Ifd0.Exif.ExposureBiasValue           = 0 APEX
JPEG.APP1.Ifd0.Exif.MaxApertureValue            = 2.96875 APEX = ‘f2.8′
JPEG.APP1.Ifd0.Exif.MeteringMode                = 5 = ‘Pattern’
JPEG.APP1.Ifd0.Exif.Flash                       = 24 = ‘no flash – auto’
JPEG.APP1.Ifd0.Exif.FocalLength                 = 7.7 mm
JPEG.APP1.Ifd0.Exif.MakerNote                   = @718:2372    # UNDEFINED
JPEG.APP1.Ifd0.Exif.UserComment                 = @3090:264 = ” # CC=’undefined’    # UNDEFINED
JPEG.APP1.Ifd0.Exif.FlashPixVersion             = ‘0100′
JPEG.APP1.Ifd0.Exif.ColorSpace                  = 1 = ’sRGB’
JPEG.APP1.Ifd0.Exif.PixelXDimension             = 3648
JPEG.APP1.Ifd0.Exif.PixelYDimension             = 2736
JPEG.APP1.Ifd0.Exif.FocalPlaneXResolution       = 12710.8
JPEG.APP1.Ifd0.Exif.FocalPlaneYResolution       = 12725.6
JPEG.APP1.Ifd0.Exif.FocalPlaneResolutionUnit    = 2 = ‘pixels per inch’
JPEG.APP1.Ifd0.Exif.SensingMethod               = 2 = ‘One-chip color area sensor’
JPEG.APP1.Ifd0.Exif.FileSource                  = 3 = ‘DSC’
JPEG.APP1.Ifd0.Exif.MakerNote.Offset                    = @718
JPEG.APP1.Ifd0.Exif.MakerNote.Length                    = 2372
JPEG.APP1.Ifd0.Exif.MakerNote.Scheme                    = ‘Plain IFD’
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings            = ‘45 entries’
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.01_MacroMode               = 3026 = ‘undefined’
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.02_SelfTimer               = 0 = ‘off’
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.03_Quality                 = 0 = ‘unknown’
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.04_FlashMode               = 0 = ‘flash did not fire’
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.05_ContinuousMode          = 92 = ‘undefined’
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.06_Unknown                 = 2
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.07_FocusMode               = 0 = ‘One Shot AF’
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.08_Unknown                 = 5
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.09_Unknown                 = 5
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.10_ImageSize               = 0 = ‘Large’
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.11_EasyShootMode           = 0 = ‘Full Auto’
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.12_DigitalZoom             = 4 = ‘(2 * ZoomedResBase) / ZoomedResValue**’
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.13_Contrast                = 65535 = ‘Low’
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.14_Saturation              = 1 = ‘High’
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.15_Sharpness               = 0 = ‘Normal’
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.16_ISO                     = 0/0 = ‘Use Exif ISOSpeedRating’
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.17_MeteringMode            = 0 = ‘Default’
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.18_FocusType               = 0 = ‘Manual’
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.19_AFPositionSelected      = 0 = ‘undefined’
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.20_ExposureMode            = 0 = ‘Easy Shooting’
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.21_Unknown                 = 15
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.22_LensType                = 3
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.23_FocalLength_long        = 1 units
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.24_FocalLength_short       = 16390 units
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.25_FocalUnits*             = 0 unit per mm
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.26_Unknown                 = 32767
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.27_Unknown                 = 65535
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.28_FlashActivity           = 0×5a3c = ‘undefined’
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.29_FlashDetails            = 0×1e14 = ‘external E-TTL,Internal flash**,2nd-curtain sync used,FP sync enabled’
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.30_Unknown                 = 1000
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.31_Unknown                 = 95
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.32_FocusMode               = 192 = ‘undefined’
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.33_undefined               = 0xffff/65535
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.34_undefined               = 0/0
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.35_undefined               = 0/0
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.36_ZoomedResValue**        = 0
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.37_ZoomedResBase**         = 0
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.38_undefined               = 0/0
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.39_undefined               = 0xffff/65535
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.40_undefined               = 0/0
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.41_undefined               = 0xe40/3648
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.42_ColorTone**             = 0xe40/3648
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.43_undefined               = 0/0
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.44_undefined               = 0/0
JPEG.APP1.Ifd0.Exif.MakerNote.CameraSettings.45_undefined               = 0xffff/65535
JPEG.APP1.Ifd0.Exif.MakerNote.FocusInfo                 = ‘4 entries’
JPEG.APP1.Ifd0.Exif.MakerNote.FocusInfo.00_unknown                = 0
JPEG.APP1.Ifd0.Exif.MakerNote.FocusInfo.01_FocalLength            = 32767
JPEG.APP1.Ifd0.Exif.MakerNote.FocusInfo.02_FocalPlaneXSize        = 32767
JPEG.APP1.Ifd0.Exif.MakerNote.FocusInfo.03_FocalPlaneYSize        = 0
JPEG.APP1.Ifd0.Exif.MakerNote.TAG_0X0003                = 0,2,7700,294
JPEG.APP1.Ifd0.Exif.MakerNote.ShotInfo                  = ‘33 entries’
JPEG.APP1.Ifd0.Exif.MakerNote.ShotInfo.01_Unknown                      = 00
JPEG.APP1.Ifd0.Exif.MakerNote.ShotInfo.02_ISO                          = 0
JPEG.APP1.Ifd0.Exif.MakerNote.ShotInfo.03_Unknown                      = 00
JPEG.APP1.Ifd0.Exif.MakerNote.ShotInfo.04_Unknown                      = 00
JPEG.APP1.Ifd0.Exif.MakerNote.ShotInfo.05_Unknown                      = 0×4468
JPEG.APP1.Ifd0.Exif.MakerNote.ShotInfo.06_ExposureCompensation**       = 65523
JPEG.APP1.Ifd0.Exif.MakerNote.ShotInfo.07_WhiteBalance                 = 160 = ‘undefined’
JPEG.APP1.Ifd0.Exif.MakerNote.ShotInfo.08_Unknown                      = 0×125293
JPEG.APP1.Ifd0.Exif.MakerNote.ShotInfo.09_SequenceNumber               = 192
JPEG.APP1.Ifd0.Exif.MakerNote.ShotInfo.10_Unknown                      = 0xea234JPEG.APP1.Ifd0.Exif.MakerNote.ShotInfo.11_Unknown                      = 00
JPEG.APP1.Ifd0.Exif.MakerNote.ShotInfo.12_Unknown                      = 00
JPEG.APP1.Ifd0.Exif.MakerNote.ShotInfo.13_Unknown                      = 00
JPEG.APP1.Ifd0.Exif.MakerNote.ShotInfo.14_AFPositionUsed               = 0 = ‘MF’
JPEG.APP1.Ifd0.Exif.MakerNote.ShotInfo.15_FlashBias                    = 0 = ‘0 EV’
JPEG.APP1.Ifd0.Exif.MakerNote.ShotInfo.16_AutoExposureBracketing**     = 0
JPEG.APP1.Ifd0.Exif.MakerNote.ShotInfo.17_AEBracketValue**             = 0
JPEG.APP1.Ifd0.Exif.MakerNote.ShotInfo.18_Unknown                      = 00
JPEG.APP1.Ifd0.Exif.MakerNote.ShotInfo.19_FocusDistanceMax**           = 0 mm
JPEG.APP1.Ifd0.Exif.MakerNote.ShotInfo.20_FocusDistanceMin**           = 0 mm
JPEG.APP1.Ifd0.Exif.MakerNote.ShotInfo.21_ApertureValue**              = 0
JPEG.APP1.Ifd0.Exif.MakerNote.ShotInfo.22_ExposureTime**               = 0
JPEG.APP1.Ifd0.Exif.MakerNote.ShotInfo.23_Undefined                    = 0×11
JPEG.APP1.Ifd0.Exif.MakerNote.ShotInfo.24_BulbDuration**               = 73
JPEG.APP1.Ifd0.Exif.MakerNote.ShotInfo.25_Undefined                    = 00
JPEG.APP1.Ifd0.Exif.MakerNote.ShotInfo.26_Undefined                    = 0xb9185JPEG.APP1.Ifd0.Exif.MakerNote.ShotInfo.27_AutoRotate**                 = 231
JPEG.APP1.Ifd0.Exif.MakerNote.ShotInfo.28_Undefined                    = 00
JPEG.APP1.Ifd0.Exif.MakerNote.ShotInfo.29_SelfTimer2**                 = 0
JPEG.APP1.Ifd0.Exif.MakerNote.ShotInfo.30_Undefined                    = 00
JPEG.APP1.Ifd0.Exif.MakerNote.ShotInfo.31_Undefined                    = 0xfa250JPEG.APP1.Ifd0.Exif.MakerNote.ShotInfo.32_Undefined                    = 00
JPEG.APP1.Ifd0.Exif.MakerNote.ShotInfo.33_Undefined                    = 00
JPEG.APP1.Ifd0.Exif.MakerNote.TAG_000000                = 0,0,0,0,0,0
JPEG.APP1.Ifd0.Exif.MakerNote.ImageType                 = ”
JPEG.APP1.Ifd0.Exif.MakerNote.FirmwareVersion           = ‘EG’
JPEG.APP1.Ifd0.Exif.MakerNote.ImageNumber               = 1003599
JPEG.APP1.Ifd0.Exif.MakerNote.OwnerName                 = ‘on 1.00′
JPEG.APP1.Ifd0.Exif.MakerNote.TAG_0X000D                = 0,0,24313856 … ,2031616 (148)
JPEG.APP1.Ifd0.Exif.MakerNote.TAG_0X0010                = 25755648
JPEG.APP1.Ifd0.Exif.MakerNote.TAG_000000                = 0,9,0,770,11057 … ,0 (19)
JPEG.APP1.Ifd0.Exif.MakerNote.TAG_0X0026                = 0,0,0,0,0 … ,41 (48)JPEG.APP1.Ifd0.Exif.MakerNote.TAG_0X0013                = 41,16,0,0
JPEG.APP1.Ifd0.Exif.MakerNote.TAG_0X0018                = 04,00,00,00,00,00,00,00,00,00 … ,00 (256)
JPEG.APP1.Ifd0.Exif.MakerNote.TAG_0X0019                = 1
JPEG.APP1.Ifd0.Exif.MakerNote.TAG_0X001C                = 0
JPEG.APP1.Ifd0.Exif.MakerNote.TAG_0X001D                = 0,0,0,0,0 … ,0 (16)
JPEG.APP1.Ifd0.Exif.MakerNote.TAG_0X001E                = 16777984
JPEG.APP1.Ifd0.Exif.MakerNote.TAG_0X001F                = 0,0,0,0,0 … ,0 (69)
JPEG.APP1.Ifd0.Exif.MakerNote.TAG_0X0022                = 0,0,0,0,0 … ,0 (208)JPEG.APP1.Ifd0.Exif.MakerNote.TAG_0X0023                = 0,0
JPEG.APP1.Ifd0.Exif.MakerNote.TAG_0X0024                = 0,8,0,0,0 … ,0 (78)
JPEG.APP1.Ifd0.Exif.MakerNote.TAG_0X0025                = 00,00,00,00,00,00,00,00,00,00 … ,00 (14)
JPEG.APP1.Ifd0.Exif.MakerNote.TAG_0X0027                = 0,4
JPEG.APP1.Ifd0.Exif.MakerNote.TAG_0X0028                = 00,00,00,00,00,00,00,00,00,00 … ,df (16)
JPEG.APP1.Ifd1.Compression                 = 6 = ‘Exif/old JPEG’
JPEG.APP1.Ifd1.XResolution                 = 180
JPEG.APP1.Ifd1.YResolution                 = 180
JPEG.APP1.Ifd1.ResolutionUnit              = 2 = ‘pixels per inch’
JPEG.APP1.Ifd1.JPEGInterchangeFormat       = @3464
JPEG.APP1.Ifd1.JPEGInterchangeFormatLength = 7012
# Start of JPEG baseline DCT compressed primary image [985x739<=3648x2736] length 145653 at offset 0/0
#   End of JPEG primary image data at offset 0×238f4/145652
# Start of JPEG baseline DCT compressed reduced-resolution image [160x120] length 7012 (IFD 1) at offset 0xd88/3464
#   End of JPEG reduced-resolution image data at offset 0×28eb/10475
NumberOfImages = 2
FileFormat = JPEG/APP0/JFIF/APP1/TIFF/EXIF # with MakerNote (Canon [1])