What EXIF Metadata Reveals: And Why Its Absence Proves Nothing

EXIF metadata is the closest thing a photograph has to a birth certificate. It is also unsigned, unverified plain text that anyone can edit in seconds.

What a camera writes

A typical original camera file carries: make and model, lens, focal length, aperture, shutter speed, ISO, orientation, capture timestamp, colour profile, firmware version, and often GPS coordinates. Some cameras add serial numbers and shutter actuation counts.

That is a lot of corroborating detail. If a photo claims to be a night shot but reports ISO 100 at 1/500s, something is wrong.

Why absence proves nothing

Almost every major platform strips EXIF on upload, for good privacy reasons, GPS coordinates in a published photograph have endangered people. So:

An image with no EXIF is overwhelmingly likely to be a normal photo that went through a normal platform. Missing metadata is weak evidence of anything.

Why presence proves little more

EXIF is not cryptographically signed. Free tools rewrite any field in seconds. A file claiming to be from a specific camera at a specific time and place is making an assertion, not providing proof.

Where EXIF becomes genuinely useful is internal consistency. Forgers usually change one or two fields and leave the rest untouched, producing combinations that no real camera would write: a timestamp that disagrees with the thumbnail’s embedded timestamp, a lens that was never sold for that mount, a software tag from an editor on a file claiming to be straight from camera.

What our tool reads

We deliberately do not parse the full EXIF block. Our metadata layer works on properties that survive stripping:

• Dimensions and aspect ratio: whether they match standard camera output or suggest cropping or generation at a model’s native size.
• Format signature: the container and how it was written.
• Bits per pixel: file size against pixel count, a rough proxy for compression history.

These are weaker signals than full EXIF, but they cannot be trivially forged by editing a text field, and they are present even on stripped files. inspect a file to see what survives.

Content Credentials, and why they matter more

The durable fix is not better metadata forensics, it is signed provenance. C2PA Content Credentials attach a cryptographically signed manifest recording capture device and every subsequent edit. Tampering breaks the signature.

Adoption is growing across camera manufacturers, editing software and generative tools, and the C2PA standard. It will not solve everything (an unsigned image is not thereby fake, and most of the world’s images will remain unsigned for years) but it converts the question from “can we detect the edit?” to “can we verify the chain?”, which is a far more tractable problem.