MOBILE FORENSICS

Forensic analysis of EXIF metadata in images

Digital photos often contain far more information than the visible image. EXIF metadata may include details such as the camera used, the time the photo was taken or – if enabled – the location where it was taken. In IT forensics, this metadata often forms an important part of the overall technical assessment.

Recording time and timestamp
GPS coordinates (where available)
Camera manufacturer and model
Lens specifications
Shutter speed, ISO and aperture
Image orientation
Serial numbers of individual cameras (depending on the model)
Information about image editing
IPTC and XMP metadata

TECHNICAL BACKGROUND

Technical Fundamentals

EXIF (Exchangeable Image File Format) stores additional technical information directly within an image file.

Information relevant to forensic investigations may include, amongst other things:

  • •Recording time and timestamp
  • •GPS coordinates (where available)
  • •Camera manufacturer and model
  • •Lens specifications
  • •Shutter speed, ISO and aperture
  • •Image orientation
  • •Serial numbers of individual cameras (depending on the model)
  • •Information about image editing
  • •IPTC and XMP metadata

Not every image file contains all the information. The scope and content depend on the device used to capture the image and any subsequent editing.

OUR APPROACH

This is how your examination will be carried out

A transparent process – from the initial enquiry to the handover of the report.

1
As part of a forensic investigation, image files are backed up bit-for-bit and then analysed using recognised IT forensic tools and manual procedures. EXIF, IPTC and XMP metadata are evaluated alongside file system information and other technical artefacts to enable the most comprehensive and traceable overall analysis possible.
2
LanCologne produces expert reports for private individuals, as well as for companies and solicitors. Our reports have already been used in court proceedings. In some cases, we have been directly commissioned to produce IT forensic reports. Upon request, we can provide anonymised or redacted sample reports or extracts.

TYPICAL QUESTIONS

When is this analysis required?

  • ✔When was a photo taken?
  • ✔Where was the photograph taken?
  • ✔What device was used to take the photo?
  • ✔Has the file been edited since it was created?
  • ✔Do the metadata and the image content technically match?

LIMITATIONS & CONCLUSION

What you should know

Metadata may be missing, altered or completely removed. Furthermore, not all information is stored by every recording device. Individual pieces of metadata alone therefore do not usually allow for a definitive assessment and must always be considered within the overall context of all available artefacts.

EXIF metadata often provides valuable technical information about the origin and creation of digital images. Only when combined with other forensic evidence is it possible to carry out a reliable and verifiable assessment.

CUSTOMER REVIEWS

What our customers say

4.8 out of 5 stars on Trustpilot · 54 reviews

★★★★★

“The highest standards of professionalism, prompt service and excellent communication. They made the seemingly impossible a reality. This is what genuine customer service is all about – unrivalled in Germany!”

idalein

Verified review on Trustpilot

★★★★★

“Very helpful advice, excellent responsiveness and communication. My problem was completely resolved and the lost data was recovered. I’m very satisfied and, of course, relieved!”

Layla Pankratz

Verified review on Trustpilot

★★★★★

“My problem was sorted out professionally and quickly; everyone I spoke to was always friendly, and I can still get in touch if I have any questions – I’m very grateful for that!”

a woman from Cologne

Verified review on Trustpilot

Enquire now – free initial consultation

Would you like to have image files or EXIF metadata examined by professionals? LanCologne can assist you with an objective IT forensic analysis and comprehensive expert documentation.

RELATED TOPICS

You might also be interested in

FREQUENTLY ASKED QUESTIONS

Frequently Asked Questions

Click on a question to see the answer.

What is EXIF metadata?
Additional technical information that is stored directly within many image files.
Do all the images contain GPS data?
No. Location information is only stored if it has been recorded by the recording device and has not been deleted.
Can image manipulation be detected?
Depending on the processing carried out and the metadata available, there may be technical indications of changes.
Is EXIF data admissible in court?
They constitute technical evidence, but must always be assessed in the context of other findings.
Could an expert report be drawn up on this matter?
Yes. The test results are documented in a clear and transparent manner and assessed from a technical perspective.