Fake fabricate JPEG date created

[andwan0]

I am wanting some advice from jpeg photo experts. I know that taking a photograph, the date-taken is stored in the exif embedded in the jpeg. If one wanted to fabricate/fake the date-taken then he would need to copy the file to PC, use an editor to change it. The thing is you cannot change & keep the original file. It has to be saved as a NEW jpeg file because the exif metadata is embedded with the image (hence a 2nd recompression (& larger file size).

Now, that you know about exif metadata and it can be changed, is there any way in court by law on how to tell whether a jpeg file exif metadata has been faked? The file could easily be copied back onto the camera memory.

I guess the only way is to compare the file sizes of similar photo settings to the faked photo file.... to REAL photos taken by the camera (that are still stored in memory).

Anyway other ideas or technical know-how?

[Gidders]

Originally Posted by andwan0

... (hence a 2nd recompression (& larger file size).

....

I guess the only way is to compare the file sizes of similar photo settings to the faked photo file.... to REAL photos taken by the camera (that are still stored in memory).

Re compressing a jpg needn't result in a larger file - it depends on the compression setting used in the camera - extra fine, fine, standard, economy/basic, the amount of detail in the scene, the in camera sharpening settings etc etc ... and the compression setting used when recompression - PS has a scale of 12-1 which, using files off my 8mp 20D can result in a file anything from 5/6Mb down to 150k again depending on the level of detail etc

[andy153]

Hi there - I know Nikon have Image Authentication Software - costs a lot - and is mainly used for evidence chains by courts. It will tell you if so much as one pixel has been altered since the photo was taken and if the picture has been cropped etc. It creates a unique digital fingerprint for each image taken. I understand that Courts now accept this. I don't know but I assume other manufacturers may have something similar.

[robski]

As Andy has said much has been done to help courts with digital photo forgery in recent years. i.e Photoshop will embed it own data to say what has changed from the original. It is possible to edit only the exif data without touching the image using certain off the shelf file editors. But I am sure the exif data will have it's own checksum and that would indicate something has changed. If you were expert enough (i,e somebody who wrote the photo checking software) it would be easy enough to fool the court. The likely hood of the average hacker fooling the system is very small.

[yelvertoft]

andwan0, I'm curious to know why you ask the question?

[andwan0]

Thanks, yes, found http://www.exifer.friedemann.info/ & http://www.photome.de/ & http://www.amok.am/en/freeware/amok_exif_sorter/ & http://www.sno.phy.queensu.ca/~phil/exiftool/ (all recommended by EXIF guru Friedemann Schmidt). Found that the date created in EXIF can be modified solely, leaving the rest of the binary data intact, unaltered.

I am the defendant. The claimant submitted a document with 1 picture... to accuse about a time/date of an event from the picture alone. I was curious whether we can request for the original jpeg file and get professional experts to retrieve the date from the EXIF. Then I find out that the EXIF date can easily be modified. I just wanted to experiement and try to find anyway to know if the EXIF has been modified. From my experiement, there's no way knowing.....

[andy153]

Hi Andwan0 - if I remember correctly, some traffic wardens in Greater Manchester were prosecuted for tampering with photographs, something to do with ( EXIF) time and date taken to prove parking offences - they were convicted. To challenge the photographs may be expensive but it is possible to do. Finding someone with the expertise to do it may be a job for a solicitor. If the photographs are not able to be authenticated, then it may be possible to challenge their admission as evidence to start with. Solicitor is the way.

[robski]

I've had a quick play with photome and changed one of the dates. I then checked with a file editor and only 5 bytes changed compared to the original file. These were for the date field in question. The file size remained unchanged. The software did not embed any of it's own data. So unless there is some checksum of the original exif data there is no way of knowing.

A point that maybe argued in your favour.