4

I often take screen grabs from my Apple devices for professional purposes (iPhone, iMac, Powerbook...), sometimes sharing them on forums, imgur or S.E. sites for technical support.

What informations can be gathered from the EXIF data of these screenshots (IP address, computer name, folder where image is saved...)?

After following this link from this forum, I ran a couple of tests but I am unsure of the results given by this tool, and couldn't find other online sources about this particular topic.

  • 1
    Link to the results? – HashHazard Jun 13 '16 at 19:39
2

Including sample data of an OSX screen capture from a OSX desktop parsed by three different tools below. It does not seem to contain the IP address but it does contain the make and model of your computer and in some cases some directory information (I also noticed that if you use an external display it will contain different information than if the screenshot is taken from your primary display).

Update: I just tested an iPhone screen capture (iOS 9.3.2 but with location services turned off and pretty much maximum privacy settings) and had near identical types of information for that device as the info below.

Note: Computers with different operating systems and software may include additional information not shown below. Also different tools may be better or worse at interpreting EXIF data and this may lead to some information not being listed here.

Viewing the screen captures with a hex editor seemed to indicate that most of the EXIF data was found by these tools. Again this could easily change with any given software updates.

You can upload the files to the following website to see some information on your own files: http://regex.info/exif.cgi

ICC_Profile — this block of data describes the color space used to encode pixel colors.
Profile CMM Type    appl
Profile Version 2.1.0
Profile Class   Display Device Profile
Color Space Data    RGB
Profile Connection Space    XYZ
Profile Date Time   2016:02:15 15:07:11
3 months, 26 days, 23 hours, 39 minutes, 51 seconds ago
Profile File Signature  acsp
Primary Platform    Apple Computer Inc.
CMM Flags   Not Embedded, Independent
Device Manufacturer 
Device Model    
Device Attributes   Reflective, Glossy, Positive, Color
Rendering Intent    Perceptual
Connection Space Illuminant 0.9642 1 0.82491
Profile Creator appl
Profile ID  0
Profile Description Display
Profile Description ML (hr-HR)  Thunderbolt Display
Profile Description ML (ko-KR)  Thunderbolt Display
Profile Description ML (nb-NO)  Thunderbolt Display
Profile Description ML  Thunderbolt Display
Profile Description ML (hu-HU)  Thunderbolt Display
Profile Description ML (cs-CZ)  Thunderbolt Display
Profile Description ML (da-DK)  Thunderbolt Display
Profile Description ML (uk-UA)  Thunderbolt Display
Profile Description ML (it-IT)  Thunderbolt Display
Profile Description ML (ro-RO)  Thunderbolt Display
Profile Description ML (es-ES)  Thunderbolt Display
Profile Description ML (he-IL)  Thunderbolt Display
Profile Description ML (nl-NL)  Thunderbolt Display
Profile Description ML (fi-FI)  Thunderbolt Display
Profile Description ML (zh-TW)  Thunderbolt Display
Profile Description ML (vi-VN)  Thunderbolt Display
Profile Description ML (sk-SK)  Thunderbolt Display
Profile Description ML (zh-CN)  Thunderbolt Display
Profile Description ML (ru-RU)  Thunderbolt Display
Profile Description ML (fr-FR)  Thunderbolt Display
Profile Description ML (ca-ES)  Thunderbolt Display
Profile Description ML (th-TH)  Thunderbolt Display
Profile Description ML (es-XL)  Thunderbolt Display
Profile Description ML (de-DE)  Thunderbolt Display
Profile Description ML (pt-BR)  Thunderbolt Display
Profile Description ML (pl-PL)  Thunderbolt Display
Profile Description ML (el-GR)  Thunderbolt Display
Profile Description ML (sv-SE)  Thunderbolt Display
Profile Description ML (tr-TR)  Thunderbolt Display
Profile Description ML (ja-JP)  Thunderbolt Display
Profile Description ML (pt-PT)  Thunderbolt Display
Profile Copyright   Copyright Apple Inc., 2016
Media White Point   0.94955 1 1.08902
Red Matrix Column   0.44434 0.22476 0.00548
Green Matrix Column 0.37944 0.72617 0.07797
Blue Matrix Column  0.14041 0.04907 0.74146
Red Tone Reproduction Curve (2,060 bytes binary data)
ICC Profile Aarg    (32 bytes binary data)
Video Card Gamma    (48 bytes binary data)
Native Display Info (62 bytes binary data)
Chromatic Adaptation    1.04861 0.02332 -0.05034 0.03018 0.99002 -0.01714 -0.00922 0.01503 0.75172
**Make And Model    (40 bytes binary data)**
Blue Tone Reproduction Curve    (2,060 bytes binary data)
Green Tone Reproduction Curve   (2,060 bytes binary data)
ICC Profile Aabg    (32 bytes binary data)
ICC Profile Aagg    (32 bytes binary data)

Using ImageMagick's command: identify -verbose filename

Image: EXIF-2.png
  Format: PNG (Portable Network Graphics)
  Class: DirectClass
  Geometry: 840x728+0+0
  Resolution: 56.69x56.69
  Print size: 14.8174x12.8418
  Units: PixelsPerCentimeter
  Type: TrueColorMatte
  Endianess: Undefined
  Colorspace: RGB
  Depth: 8-bit
  Channel depth:
    red: 8-bit
    green: 8-bit
    blue: 8-bit
    alpha: 1-bit
  Channel statistics:
    Red:
      min: 39 (0.152941)
      max: 243 (0.952941)
      mean: 145.848 (0.571955)
      standard deviation: 38.1181 (0.149483)
      kurtosis: -0.548953
      skewness: -0.365279
    Green:
      min: 48 (0.188235)
      max: 240 (0.941176)
      mean: 145.454 (0.570408)
      standard deviation: 33.2798 (0.130509)
      kurtosis: -0.495621
      skewness: -0.482358
    Blue:
      min: 38 (0.14902)
      max: 231 (0.905882)
      mean: 110.294 (0.432524)
      standard deviation: 28.2349 (0.110725)
      kurtosis: 0.223295
      skewness: 0.261946
    Alpha:
      min: 255 (1)
      max: 255 (1)
      mean: 255 (1)
      standard deviation: 0 (0)
      kurtosis: 0
      skewness: 0
  Image statistics:
    Overall:
      min: 0 (0)
      max: 243 (0.952941)
      mean: 100.399 (0.393722)
      standard deviation: 28.973 (0.11362)
      kurtosis: 48.6621
      skewness: -4.99921
  Rendering intent: Undefined
  Interlace: None
  Background color: white
  Border color: rgba(223,223,223,1)
  Matte color: grey74
  Transparent color: none
  Compose: Over
  Page geometry: 840x728+0+0
  Dispose: Undefined
  Iterations: 0
  Compression: Zip
  Orientation: Undefined
  Properties:
    date:create: 2016-06-13T20:35:36+00:00
    date:modify: 2016-06-13T20:34:13+00:00
    PNG:iCCP                 : chunk was found
    PNG:IHDR.bit_depth       : 8
    PNG:IHDR.color_type      : 6
    PNG:IHDR.interlace_method: 0
    PNG:IHDR.width,height    : 840, 728
    PNG:pHYs                 : x_res=5669, y_res=5669, units=1
    signature: 3e74422ab0e2b55b3cbec053dd3a147894cc35a8e2083d6a2eba2b890fba5d89
  Profiles:
    Profile-icc: 3892 bytes
      Display
  Artifacts:
    verbose: true
  Tainted: False
  Filesize: 818KBB
  Number pixels: 612KB
  Pixels per second: 7.644MB
  User time: 0.060u
  Elapsed time: 0:01.080
  Version: ImageMagick 6.6.9-7 2014-03-06 Q16 http://www.imagemagick.org

http://www.sno.phy.queensu.ca/~phil/exiftool/

ExifTool Version Number         : 10.20
File Name                       : EXIF-2.png
Directory                       : .
File Size                       : 799 kB
File Modification Date/Time     : 2016:06:13 13:28:01-07:00
File Access Date/Time           : 2016:06:13 13:46:55-07:00
File Inode Change Date/Time     : 2016:06:13 13:28:01-07:00
File Permissions                : rw-r--r--
File Type                       : PNG
File Type Extension             : png
MIME Type                       : image/png
Image Width                     : 840
Image Height                    : 728
Bit Depth                       : 8
Color Type                      : RGB with Alpha
Compression                     : Deflate/Inflate
Filter                          : Adaptive
Interlace                       : Noninterlaced
Profile Name                    : ICC Profile
Profile CMM Type                : appl
Profile Version                 : 2.1.0
Profile Class                   : Display Device Profile
Color Space Data                : RGB
Profile Connection Space        : XYZ
Profile Date Time               : 2016:02:08 13:38:48
Profile File Signature          : acsp
Primary Platform                : Apple Computer Inc.
CMM Flags                       : Not Embedded, Independent
Device Manufacturer             : 
Device Model                    : 
Device Attributes               : Reflective, Glossy, Positive, Color
Rendering Intent                : Perceptual
Connection Space Illuminant     : 0.9642 1 0.82491
Profile Creator                 : appl
Profile ID                      : 0
Profile Description             : Display
Profile Description ML (hr-HR)  : LCD u boji
Profile Description ML (ko-KR)  : 컬러 LCD
Profile Description ML (nb-NO)  : Farge-LCD
Profile Description ML (hu-HU)  : Színes LCD
Profile Description ML (cs-CZ)  : Barevný LCD
Profile Description ML (da-DK)  : LCD-farveskærm
Profile Description ML (uk-UA)  : Кольоровий LCD
Profile Description ML (it-IT)  : LCD colori
Profile Description ML (ro-RO)  : LCD color
Profile Description ML (es-ES)  : LCD color
Profile Description ML (he-IL)  : ‏LCD צבעוני
Profile Description ML (nl-NL)  : Kleuren-LCD
Profile Description ML (fi-FI)  : Väri-LCD
Profile Description ML (zh-TW)  : 彩色 LCD
Profile Description ML (vi-VN)  : LCD Màu
Profile Description ML (sk-SK)  : Farebné LCD
Profile Description ML (zh-CN)  : 彩色 LCD
Profile Description ML (ru-RU)  : Цветной ЖК-дисплей
Profile Description ML (fr-FR)  : LCD couleur
Profile Description ML (ca-ES)  : LCD en color
Profile Description ML (th-TH)  : LCD สี
Profile Description ML (es-XL)  : LCD color
Profile Description ML (de-DE)  : Farb-LCD
Profile Description ML          : Color LCD
Profile Description ML (pt-BR)  : LCD Colorido
Profile Description ML (pl-PL)  : Kolor LCD
Profile Description ML (el-GR)  : Έγχρωμη οθόνη LCD
Profile Description ML (sv-SE)  : Färg-LCD
Profile Description ML (tr-TR)  : Renkli LCD
Profile Description ML (ja-JP)  : カラー LCD
Profile Description ML (pt-PT)  : LCD a Cores
Profile Copyright               : Copyright Apple Inc., 2016
Media White Point               : 0.94955 1 1.08902
Red Matrix Column               : 0.44434 0.22476 0.00548
Green Matrix Column             : 0.37944 0.72617 0.07797
Blue Matrix Column              : 0.14041 0.04907 0.74146
Red Tone Reproduction Curve     : (Binary data 2060 bytes, use -b option to extract)
Video Card Gamma                : (Binary data 48 bytes, use -b option to extract)
Native Display Info             : (Binary data 62 bytes, use -b option to extract)
Chromatic Adaptation            : 1.04861 0.02332 -0.05034 0.03018 0.99002 -0.01714 -0.00922 0.01503 0.75172
Make And Model                  : (Binary data 40 bytes, use -b option to extract)
Blue Tone Reproduction Curve    : (Binary data 2060 bytes, use -b option to extract)
Green Tone Reproduction Curve   : (Binary data 2060 bytes, use -b option to extract)
Pixels Per Unit X               : 5669
Pixels Per Unit Y               : 5669
Pixel Units                     : meters
XMP Toolkit                     : XMP Core 5.4.0
Exif Image Width                : 840
Exif Image Height               : 728
Image Size                      : 840x728
Megapixels                      : 0.612
1

Trey already dove deeper than I would have, so I will offer a link that shares a bit more information than Troy posted. And now on to answering the most critical bit of information that an image will store. GPS coordinates. Here is data from an example photo, with a stripped summary with 'pseudo' personal information visible to exiftool

File Name                       : Example.JPG
File Modification Date/Time     : 2015:10:11 18:58:06+02:00
File Access Date/Time           : 2015:10:13 12:41:47+02:00
File Inode Change Date/Time     : 2015:10:11 18:58:06+02:00
Make                            : Apple
Camera Model Name               : iPhone 4
Software                        : 4.3.5
Date/Time Original              : 2011:09:04 12:51:11
Create Date                     : 2011:09:04 12:51:11
Scene Capture Type              : Standard
GPS Latitude Ref                : North
GPS Longitude Ref               : East
GPS Altitude Ref                : Above Sea Level
GPS Time Stamp                  : 11:07:47
GPS Img Direction Ref           : True North
GPS Img Direction               : 82.12307692
GPS Date Stamp                  : 2011:09:04
Date Created                    : 2011:09:04 12:51:11
GPS Altitude                    : 0 m Above Sea Level
GPS Date/Time                   : 2011:09:04 11:07:47Z
GPS Latitude                    : 38 deg 54' 35.40" N
GPS Longitude                   : 1 deg 26' 19.20" E
GPS Position                    : 38 deg 54' 35.40" N, 1 deg 26' 19.20" E

So on your iPhone, your coordinates are stored. NOT your IP address, NOT the name of your router, NOT the name of your roommate, and so forth. This is the "juiciest" data you will get from metadata on a phone unless you modify the metadata and insert your own information. On the one hand, it can give someone the ability to find where you've been, where you are (taking a selfie at home), but that is all. As for websites... This all depends on the website. Twitter scrubs metadata from photos, imgur, seems hit or miss. If your main concern is privacy, you could use the same tool (exiftool) to scrub your data, e.g.:

find . -type f -exec file --mime-type {}  \; |\
awk '{if ($NF == "image/jpeg") print "exiftool -geotag= "$1 }' |\
sed 's#:$##g' | sh

COMMAND ABOVE EXPLAINED: Find everything in this directory, make sure that it is a jpeg. When you find it, run exiftool against it, and remove any geolocation data in it. Because find is going to append a colon at the end of each image it finds, remove the colon, and run the command for me. Instant gratification. You could remove the -geotag= statement, and replace it with -all= if you are really paranoid.

  • I love this answer! Great job. – MicroMachine Jun 13 '16 at 21:53
  • 2
    This is about a photo. The question is asking about screenshots. – André Borie Jun 14 '16 at 8:41
  • @AndréBorie you do know that when you SAVE a screenshot it is an image, much like the way a photo is an image. Exiftool and others will show the same information whether it is a screenshot, photo, animated gif, rendered JPEG, rastered TIFF. The parameters around what is gathered (metadata) remain the same for IMAGE files, regardless of the medium that took it (camera, embedded camera, phone, etc) – munkeyoto Jun 14 '16 at 11:00
  • 2
    @munkeyoto except software that populates EXIF fields is free to choose what it puts there. For example, the camera app will put GPS info in there if possible, but I'd be surprised if the code that is responsible with taking screenshots does the same. – André Borie Jun 15 '16 at 23:38
0

It is quite easy to search the App Store for 'exif viewer' and find a half dozen free apps that will show you all the EXIF data for each shot in your iPhone's photo library. These tools will show you if there is GPS data regarding the photo (where it was taken), the serial number of the camera (or iPhone), the name of the photographer, the time the photo was taken, the timezone the phone was set to, etc.

You should look through the EXIF data for yourself to determine if it's leaking information you didn't expect. There are hundreds of possible data elements defined by EXIF, and we can't tell you what is or isn't important to you in your particular case.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.