IT Forensics · Private Individuals

How can I find out when a photo was actually taken?

The date displayed by a gallery app is not necessarily the time the photo was taken. It may be derived from the EXIF data, the file system time, the time of import, or the time it was received via a messaging app. To establish a reliable time, several independent sources must all agree.

Enquire without obligation

Why this question is important for private individuals

Chats, photos, videos and screenshots can carry considerable weight in private, civil or criminal disputes. However, the fact that they are visible does not automatically answer questions regarding their origin, whether they have been altered, when they were created or who created them.

Technical background

EXIF fields such as DateTimeOriginal, OffsetTimeOriginal and GPS time are recorded by the camera – based on the device’s clock. Messaging apps often remove metadata when messages are sent. Cloud services add their own upload times. Editing programmes may overwrite these fields.

Relevant evidence and data sources

• EXIF/XMP: DateTimeOriginal, time zone offset, GPS timestamp, camera model, serial number
• File system times on the device or memory card
• The smartphone’s photo database (e.g. Photos.sqlite on iOS)
• Upload and receipt times in the cloud or Messenger
• Image content plausibility (e.g. shadows, weather, visible time)

Borders

• If only a forwarded copy without metadata is available, it is often impossible to determine the exact time.
• EXIF data can be altered; individual timestamps do not, on their own, prove anything.

Possible results

• The date of the recording is supported by several sources
• Time can only be narrowed down (earliest/latest time)
• Indications of subsequent alterations to timestamps

Why LanCologne?

To the untrained eye, digital evidence often appears more conclusive than it actually is from a technical point of view. A screenshot may look genuine, yet still have been altered.

Here’s how we do it

• Back up the original file – or, better still, the recording device.
• Read all available time sources and take time zones and the device’s internal clock into account.
• Explain any contradictions or flag them as unresolved.

Authenticity is not the same as authorship

Technically speaking, a message may be authentically stored in an account or on a device without this alone providing conclusive evidence as to which natural person authored it. This distinction prevents a correct technical finding from being conflated with an unsubstantiated claim regarding a person’s identity.

Original data is more important than the mere on-screen display

A screenshot can be valuable, particularly if content disappears later on. However, for a more in-depth investigation, we also try to obtain original files, app data, databases or other primary sources. These often contain context that is missing from the visible display.

Why use the LanCologne approach when examining digital evidence?

LanCologne does not treat digital content as true or false simply because it appears plausible. We examine the available technical evidence, document its origin and limitations, and present our findings in such a way that they are understandable to private clients whilst remaining verifiable by lawyers, investigating authorities, the courts or other qualified IT forensic experts.

In the case of tampered digital evidence, Section 269 of the German Criminal Code (StGB) may be relevant, depending on the specific circumstances. Subject to the conditions set out in the provision, this applies to the storage or alteration of data relevant to evidence with the intention to deceive, or the use of such stored or altered data. Whether a specific file or message fulfils all the elements of the offence is a legal question; a technical finding of manipulation alone does not answer this.

Section 371 of the Code of Civil Procedure (ZPO) is relevant to civil proceedings. Under this provision, evidence by inspection may also be adduced through the production or transmission of electronic documents. Section 371a of the ZPO contains specific provisions on the evidential value of electronic documents, in particular in the case of qualified electronic signatures and certain public electronic documents. Consequently, not every ordinary chat message or image file automatically possesses the specific evidential value set out in those provisions.

Sections 402 et seq. of the Code of Civil Procedure (ZPO) apply to expert evidence. A privately commissioned IT forensic report does not constitute a court expert report solely on the basis of its technical quality. However, its transparent methodology and the evidence on which it is based may be important for lawyers and for subsequent expert review.

Hash values are an important integrity tool, but they do not guarantee the authenticity of the original content. A hash records that a particular set of data has remained unchanged since the hash was generated, or that it matches a reference set bit by bit. It does not automatically indicate whether the content had been tampered with prior to being saved.

LanCologne assesses technical data and its significance. The legal evaluation of evidence, its classification under criminal law, and the decision as to what weight to give to which evidence during proceedings are the responsibility of solicitors, investigating authorities and the courts.

Frequently Asked Questions

Related topics

• How can I find out whether a photo has been edited?
• How can I find out whether photos of damage or evidence have been tampered with?
• IT Forensics for Private Individuals

LanCologne – IT Forensics for Private Individuals

Do you have a digital enquiry? LanCologne can assist you with an objective, unbiased IT forensic investigation.

Get in touch now