I have a JPG and I am analyzing it to determine it's efficacy. The image metadata clearly indicates that the image was digitized at
15:10:13, Dec 31, 2015 and I need to determine if this
date digitized has been altered in any way.
- I have forensically the image in question (maintaining chain of custody) from the receiver's iphone6.
- The sender used an iphone4s.
- No other received images from this (or any) sender have been found to have a mismatch of EXIF data.
- From this answer, I can see that it would be difficult to prove with absolute certainty that the data has or has not changed but I am more interested in the how the data could have changed (in reasonable ways -ie no alien hackers).
- Just to clarify, there is no reasonable suspension that the sender deliberately directly altered, had someone else alter, or has been affected by malware that alters the EXIF data.
20:10:23 UTC Dec 31, 2015which does correspond to correct localised timeStamp.
Assuming the sender:
- Does not have any third party apps installed that can modify EXIF data.
- Has no intent/motive to edit EXIF data.
- Is not infected with malware that does edit EXIF data.
- Both the receiver and sender used the
iMessageapp and the message was sent as an iMessage.
- Both the receiver and sender are on the same cell carrier (T-Mobile) and located in the USA.
- The timezone of the sender and receiver are the same and no timezone travel has occurred in the sample period.
- The date and time on the sender and receiver's devices are correct.
I cannot replicated the alleged modification. Here is what I have tried:
- As per this article, I have tried sending a control JPG within the
take a photo. This had the effect of limiting the EXIF data (did not have sensor data or DateTime Digitized) and eliminated GPS data altogether which is the opposite of the alleged modification.
- Sending various control JPGs that include the follow control cases; have not been modified at all, been edited in Apple's own image editor (eg just cropped), taken with front and rear camera, sent via the
select photooption in
iMessageas well as sent directly from
- Sent image in various states (as described above) with and without a message added to the imessage (ie when adding the photo by any means I added "test" text to the message before sending the imessage.
From what I have tried, I conclude that the
date digitized is indeed valid however there is reason to believe it is not and we need to determine how it could have changed (within my parameters -ie no third party app or person).
How could the EXIF data have be changed automatically, specifically the "DateTime Digitized/Original" data? Is it likely that it can be changed via
iMessage, Apple, the IOS, or the Iphone(s) at all?
I have included a snapshot of the EXIF data (from Apple's more visually pleasing
inspector tool, the actual forensic examination shows the same thing in binary.