EXIF tells you what the camera saw. C2PA Content Credentials tell you what every tool in the chain did to the photo afterwards — captured by Sony Alpha, edited in Adobe Photoshop, exported, watermarked, published — with…
Among the dozens of fields in a typical EXIF block, six can pin a photo to one specific piece of hardware. Five are standardised in the EXIF specification and visible to any reader; one hides inside the vendor's private…
"What metadata is in this photo" looks like one question and is actually three. JPEGs (and many other formats) carry up to three independent metadata blocks, written by different actors at different times, defined by…
There's a category of software that most people never come across. It is not just because of obscurity, but because it works so quietly in the background, you'll only ever discover it when you need it. ExifTool belongs…
Consider a common scenario. You are a wedding photographer. Three years after a shoot, the father of the bride calls and asks for a specific photo. Your archive holds 400,000 images. Without good metadata, that search…
Every modern OS has a built-in way to strip image metadata, but the mechanics differ by vendor and version. None of the built-ins strip everything — they're aimed at the obvious privacy risk (GPS) and leave technical…
AI-generated images are now common in social feeds. Some are obvious, but many are hard to distinguish from photographs at a glance. Automated detection is unreliable, so one of the better starting points for…
Most metadata in a photo is informational — interesting if you care about who shot it, irrelevant if you just want to display the pixels. The ICC profile is the exception. It changes how the pixels are rendered. Strip…
EXIF tag 0x927C is called MakerNote. The specification reserves it as a binary blob of arbitrary length and structure, controlled entirely by the camera vendor. Every major manufacturer fills it with their own private…
There is a recurring category of news story that goes like this: a government agency or law firm releases a redacted PDF, and within hours readers discover that some "redacted" sections are still readable. In many cases…
The GPS Image File Directory is a sub-block of EXIF that camera phones write by default whenever location services are enabled for the camera app. It records latitude, longitude, altitude, heading, and the timestamp…
EXIF doesn't just describe the photo. It carries a second photo inside the first — a small JPEG generated at capture time, typically 160×120, used by cameras and phones to render gallery previews without decoding the…
EXIF carries three independent timestamp fields plus three subsecond companions, and as of EXIF 2.31 a separate UTC offset. Most of the time they agree. When they don't — and they don't more often than people expect —…
Run ExifTool on an unedited video straight from your phone. The output usually covers more than just codec and resolution: camera model, lens info, GPS coordinates sampled during the recording, gyroscope data, audio…
In digital forensics, pixels alone are often ambiguous, but the metadata attached to a file is usually a more reliable record of how and where an image was created. Every photo you take, whether it is of your dog or of…
Every public-facing social platform claims to "protect your privacy". Most strip GPS coordinates from photos on upload. Almost none strip the rest of the EXIF data, and almost all leak something — the camera model, the…
Every photo from a modern camera or phone carries a hidden block of structured data describing how the picture was taken. Camera body, lens, shutter speed, aperture, ISO, white balance, the exact second the photo was…
You are browsing used gear and find a Canon 5D Mark III listed at a low price. The body looks clean in the photos and the seller describes it as a backup that rarely left the studio. Before buying, you ask for a recent…