7

I have a JPG and I am analyzing it to determine it's efficacy. The image metadata clearly indicates that the image was digitized at 15:10:13, Dec 31, 2015 and I need to determine if this date digitized has been altered in any way.

Notes:

  • I have forensically the image in question (maintaining chain of custody) from the receiver's iphone6.
  • The sender used an iphone4s.
  • No other received images from this (or any) sender have been found to have a mismatch of EXIF data.
  • From this answer, I can see that it would be difficult to prove with absolute certainty that the data has or has not changed but I am more interested in the how the data could have changed (in reasonable ways -ie no alien hackers).
  • Just to clarify, there is no reasonable suspension that the sender deliberately directly altered, had someone else alter, or has been affected by malware that alters the EXIF data.
  • The GPS TimeStamp says 20:10:23 UTC Dec 31, 2015 which does correspond to correct localised timeStamp.

Assuming the sender:

  • Does not have any third party apps installed that can modify EXIF data.
  • Has no intent/motive to edit EXIF data.
  • Is not infected with malware that does edit EXIF data.
  • Both the receiver and sender used the iMessage app and the message was sent as an iMessage.
  • Both the receiver and sender are on the same cell carrier (T-Mobile) and located in the USA.
  • The timezone of the sender and receiver are the same and no timezone travel has occurred in the sample period.
  • The date and time on the sender and receiver's devices are correct.

I cannot replicated the alleged modification. Here is what I have tried:

  • As per this article, I have tried sending a control JPG within the iMessage app via take a photo. This had the effect of limiting the EXIF data (did not have sensor data or DateTime Digitized) and eliminated GPS data altogether which is the opposite of the alleged modification.
  • Sending various control JPGs that include the follow control cases; have not been modified at all, been edited in Apple's own image editor (eg just cropped), taken with front and rear camera, sent via the select photo option in iMessage as well as sent directly from Photos app.
  • Sent image in various states (as described above) with and without a message added to the imessage (ie when adding the photo by any means I added "test" text to the message before sending the imessage.

From what I have tried, I conclude that the date digitized is indeed valid however there is reason to believe it is not and we need to determine how it could have changed (within my parameters -ie no third party app or person).

How could the EXIF data have be changed automatically, specifically the "DateTime Digitized/Original" data? Is it likely that it can be changed via iMessage, Apple, the IOS, or the Iphone(s) at all?

I have included a snapshot of the EXIF data (from Apple's more visually pleasing inspector tool, the actual forensic examination shows the same thing in binary.

exif

Improve this question
1
  • Perhaps but the timezone should be the same. Also, it should have been more than 24hrs past
    – Matthew Peters
    Jan 3, 2016 at 21:39

3 Answers 3

Reset to default
9

This could be due to many reasons. I'll share the most likely:

  • The user has an app to randomize/change EXIF data/file property data. There's an app for that. Such a program is usually used by those who are paranoid and want some kind of plausible deniability, or maybe they're just bored and messing with you.
  • iMessage should allow you to send images with EXIF data intact, while standard MMS will not. This is a limitation of the MMS protocol. iMessage and MMS aren't the same. Note that you can remove GPS data by not allowing geotagging in the settings. Try another control picture with geotagging enabled in your iPhone. Settings > General > Location Services > On/Off.

This is an idea but there shouldn't be any EXIF data on here if the picture 'started out' as an SMS picture...

Notice that this is from the iPhone 4. The iPhone 6S is the current phone. Things have changed. Your link is from nearly 4 years ago. Updates can add or remove features, even on older devices such as the iPhone 4s, your target machine.

Since we are talking about forensics, you might be working in law enforcement. If this is the case, then you should try to get a hold of an updated iPhone 4s. Take a picture of anything, and use iMessage to send it to another one of your devices. Verify that the EXIF data is either intact or missing. From there, you should be pointed in the right direction.

If you have already seized the iPhone in question, and you found the EXIF data on the iPhone, it's possible it didn't get transmitted via SMS. If you got the EXIF data from a phone that received the SMS, then you'll know it can be transmitted.

The article I linked seems to suggest that EXIF data is now included by default. Many other articles indexed by Google also suggest the same.

Improve this answer
7
  • If you notice the image in question is indeed from an iphone 4s. I'll edit the question to clarify. Also, the concept of sending a message via the in message prompt take photo does yield a non EXIF image even in the newest model iphone.
    – Matthew Peters
    Jan 4, 2016 at 11:23
  • @MatthewPeters Yeah, I brought that up in the first paragraph below your question.
    – Mark Buffalo
    Jan 4, 2016 at 13:05
  • I have clarified my question a lot now, I apologize if I wasnt so clear yesterday (I dont normally work on Sundays and so was brief :).
    – Matthew Peters
    Jan 4, 2016 at 13:29
  • @MatthewPeters iMessage may allow EXIF data to be sent. SMS/MMS should not allow this, as that's a limitation of the MMS protocol. Try sending with iMessage, not MMS. I've updated my answer to reflect that.
    – Mark Buffalo
    Jan 4, 2016 at 14:13
  • @MatthewPeters When you say, "limiting EXIF data," what do you mean? I'd like to see the "limited" result.
    – Mark Buffalo
    Jan 4, 2016 at 14:20
3

Any app that has permissions to view and edit photos or access the file system where the photos are stored could change this data. EXIF data, modify/access/created times, etc are not immutable.

It will always be speculative how it could be changed or if a third party app (e.g., another photography app beyond the stock app) added EXIF data when it was not expected to be added. As @Mark Buffalo noted in this answer, there are so many places along the line or factors that could impact the presence or changes to metadata. Unless you are dealing with signed and timestamped information, you do not have any reasonable assurance over the provenance of data.

Improve this answer
8
  • The first part is true but unlikely in this case. As for the second point, could you elaborate on what other factors would make a non extra-ordinary imessage behave in the alleged manner?
    – Matthew Peters
    Jan 4, 2016 at 13:33
  • @MatthewPeters Why is this unlikely? Is an old lady the recipient?
    – Mark Buffalo
    Jan 7, 2016 at 18:10
  • @MarkBuffalo, it is unlikely because there is no motive for altering the photo's metadata.
    – Matthew Peters
    Jan 8, 2016 at 22:44
  • @MatthewPeters That you're aware of? Someone else could've done it.
    – Mark Buffalo
    Jan 8, 2016 at 23:34
  • @MarkBuffalo, I understand but that is beyond the scope of the investigation and question. Quite simply, it is still unlikely that anyone purposefully changed the data.
    – Matthew Peters
    Jan 9, 2016 at 0:09
1

SIMPLE: The GPS UTC time stamp from satelite is based off of the the satelites time from atomic clocks in London. It is a different clock than the one used to time stamp the photo from the phone (likely local cellular system time). The difference in seconds is the difference of the two clocks. 10 seconds. Very close! The difference in hours is the difference in locations of the two clocks. One in London the other in the Eastern Time Zone of the United States. 5 hours apart.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .