EXIF metadata: what it actually proves

When a photograph's authenticity is questioned, EXIF metadata is the first thing everyone looks at. And rightly so. The trouble starts when that glance is mistaken for verification: EXIF is text, and text can be rewritten.

What it is

EXIF (Exchangeable image file format, a JEITA standard, currently version 2.32) is the block of information a camera embeds inside the image file. It typically holds make and model, capture date and time, exposure settings, orientation and — if geolocation is on — GPS coordinates.

This is valuable information. It tells a coherent story and, in the vast majority of cases, a true one. The issue is different: nothing guarantees its truthfulness.

Why it is not proof

Free, widely available tools can read and rewrite any EXIF field: capture date, camera model, coordinates. No special skill is required, and the operation leaves no trace in the file.

Which means that, faced with a challenge, the argument «EXIF says the photo is from 3 March» carries exactly the same weight as «I say the photo is from 3 March». Because it is the same statement: you wrote it, or a device you control wrote it.

EXIF is an excellent indication and a poor guarantee. It helps reconstruct; it does not demonstrate.

It gets worse: it often disappears

The second problem is the opposite of the first. Metadata is not only forgeable — it is lost, constantly, with nobody intending it.

• Messaging platforms and social networks recompress images and strip most EXIF. A photo sent through a chat almost always arrives without coordinates and often without the original date.
• Screenshots and crops create a new file, carrying the metadata of the moment you pressed the key — not of when the scene was captured.
• Exports and backups may normalise or wipe fields.

The practical outcome is paradoxical: the single most important photo — the one forwarded through chats and recovered months later — is also the one with the least metadata left.

So what is it good for

Do not throw it away. Put it in the right place: it is an element of coherence, not of guarantee.

If a photo declares a certain camera model, a certain instant and certain coordinates, and all of that agrees with the rest of the available information, the reconstruction gets stronger. If something jars — coordinates incompatible with the location, a time that does not match the light in the scene, a device model different from the one claimed — that is an anomaly requiring explanation.

In short, EXIF is very good at demolishing a false reconstruction. It is very poor at sustaining a true one.

How LOCUS handles it

LOCUS takes a conservative, declared approach: the camera's original metadata is not touched. Make, model and original date remain exactly as the device wrote them. LOCUS adds only two fields — Software and UserComment — rewriting nothing pre-existing.

The reason is simple: a forensic system should not improve data, it should preserve it and make every intervention visible. The full EXIF dump is also included in the signed manifest, so the metadata itself falls under seal: if anyone edits it after acquisition, comparison with the signed copy reveals it immediately.

And that is the central point: metadata does not become reliable because we handled it well. It becomes verifiable because it is anchored to a cryptographic fingerprint, signed and timestamped by a third party. The guarantee never comes from EXIF — it comes from what encloses it.

GPS deserves its own note

Coordinates in metadata have exactly the same problem: they can be rewritten. LOCUS records position in a richer form — declared accuracy, compass heading, and for video and audio a continuous log sampled once per second rather than a single point — and includes it in the signed manifest together with the address resolution, along with the parameters a verifier needs to repeat the same query and compare results.

It remains, however, data declared by the device. A coherent, signed GPS log is far harder to fabricate than a single EXIF field, but it is not proof of position in a strict sense: it is documentation anchored to the seal. Calling it anything else would be dishonest.

Continue with does a photograph have legal value? and the date of a photo. For terminology, see the glossary.