Image Metadata: What It Can and Cannot Prove
Read EXIF dates, camera fields, GPS tags, dimensions, and hashes, then judge each clue in light of metadata that may be stripped or edited.
Read metadata as claims, not truth
Inspect the file copy
- Metadata is attached to a particular file copy and may be edited or removed.
Separate hash types
- SHA-256 supports byte-level integrity, while perceptual hashes support visual triage.
Corroborate important fields
- Corroborate important dates, locations, and creator fields with external evidence.
Inspect the submitted file with the Image Metadata Checker, then use the metadata and fingerprints learning path to separate editable fields, byte-level hashes, perceptual hashes, and signed provenance records.
Image metadata can record camera settings, capture time, software, orientation, and location. It is helpful, but it is not a truth certificate. The guide to reading image metadata without overclaiming separates what a field states from what independent evidence confirms.
Fields worth checking
- DateTimeOriginal: the camera's claimed capture time.
- Make and Model: the device information written by the camera.
- GPSInfo: coordinates, when location tagging was enabled.
- Software: an application that last saved the file.
- Dimensions and orientation: useful for spotting resizes and rotations.
Record a cryptographic hash
A SHA-256 hash identifies the exact bytes of a file. If one pixel or metadata field changes, the hash changes. A matching hash strongly supports that two files are byte-for-byte identical, but a different hash does not mean the visual content is unrelated.
Interpret missing metadata
Missing EXIF is common after social uploads, screenshots, exports, and privacy cleaning. It does not prove manipulation. Treat a field that conflicts with well-supported external evidence as a reason to investigate further.
Build a field-by-field interpretation record
Do not copy a metadata dump into a report without explaining what each field can support. Record the field name, raw value, which file copy was inspected, and whether another field or external source agrees. A timestamp may reflect capture, scanning, export, or software processing depending on the field. A GPS value may be precise, deliberately generalized, copied from another file, or absent after platform processing.
Use the image metadata checker on the best available original, then preserve its SHA-256 fingerprint. If a later download produces different bytes, compare the visual and metadata records instead of assuming it is the same file.
Example interpretation
| Observation | Supported statement | Unsupported leap |
|---|---|---|
| A camera model is present | This file contains a field naming that model | The named camera definitely captured the scene |
| GPS coordinates are present | This copy asserts a location | The depicted event occurred there |
| No EXIF fields remain | This copy has no extracted EXIF data | The image never had metadata |
| Editing software is named | The file passed through software that wrote the field | The visual content was deceptively altered |
When two fields conflict, keep both in the record. Check time zones, camera clock settings, digitization dates, and export history before choosing an explanation. The correct outcome may be unresolved. Metadata becomes valuable when it narrows a question and can be compared with page context, creator records, and visual evidence.
Export the findings in a form that preserves the exact tag names. If the image is later converted for publication, inspect the converted copy separately and label it as a derivative. This prevents a stripped web version from being mistaken for the original file and keeps later reviewers from attributing one copy's fields to another.
Privacy check
GPS coordinates can expose a home, workplace, or repeated routine. Check metadata before publishing original photos. Save a preserved original privately before exporting a metadata-clean copy for sharing.
Continue with Image Hashes and Perceptual Hashes Explained. A practical hash selection matrix with collision, transformation, threshold, and evidence limitations made explicit. For another evidence check within the same investigation, use Content Credentials Explained.