What EXIF Data Actually Proves (and What It Doesn't)

Almost every photograph you take carries a block of metadata called EXIF — the Exchangeable image file format. It is where the timestamp lives, along with the camera model, the exposure settings, and often a set of GPS coordinates. When someone needs to establish when and where a photo was taken, EXIF is the first thing they look at.

It is also routinely overestimated. EXIF is a self-report written by the capturing device, stored in plain structured fields inside the file, and protected by nothing at all. Understanding exactly where that line falls is the difference between documentation that holds up and documentation that quietly fails at the moment it matters.

What EXIF actually is

EXIF is a specification maintained by the Camera & Imaging Products Association (CIPA). The current release is Exif Version 3.0, published as CIPA DC-008-2023, which among other changes introduced UTF-8 support for text fields — earlier versions were limited in how they could represent non-ASCII characters. Most files you encounter in the field were written against Exif 2.2, 2.3, or 2.31.

Structurally, EXIF is a set of tagged directories embedded in the image file. Each tag has a numeric identifier and a defined type. A JPEG carries them in an application marker segment; TIFF, HEIF, and most raw formats carry equivalent structures. Nothing in the format is encrypted, hashed, or signed. The fields are simply there, in the file, adjacent to the pixels.

That design is deliberate. EXIF was created so cameras could record shooting conditions for the photographer's benefit — focal length, aperture, ISO, white balance. It was never designed as an evidentiary mechanism, and it does not behave like one.

The timestamp problem

There are three date fields you will commonly see, and they mean different things:

• DateTimeOriginal — when the image was captured. This is the one people mean when they say "the EXIF date."
• DateTimeDigitized (often surfaced as CreateDate) — when the image was digitized. For a direct digital capture this usually matches DateTimeOriginal; for a scan of a print, it is the scan date.
• DateTime (often surfaced as ModifyDate) — when the file was last modified by software.

All three are stored as plain text in the form YYYY:MM:DD HH:MM:SS. Two things follow from that, and both matter.

First, the value comes from the device's own real-time clock. There is no external time authority involved, no signed timestamp, no network attestation. If the camera's clock is wrong, the EXIF date is wrong — and camera clocks drift, reset after battery changes, and are frequently left on the wrong time zone after travel. This is such a common failure that photojournalism and forensic workflows routinely include "shoot a photo of a known clock" as a calibration step.

Second, the base timestamp carries no time zone. Exif 2.31 added the OffsetTime, OffsetTimeOriginal, and OffsetTimeDigitized tags to record the UTC offset, but support is inconsistent across devices and much of what you will inspect simply lacks them. Without an offset, "14:32" is ambiguous by up to a day at the edges.

How GPS tags work, and where they fail

Location lives in a separate GPS directory. The core fields are GPSLatitude and GPSLongitude, stored as degrees, minutes, and seconds in rational form, each paired with a reference tag (GPSLatitudeRef, GPSLongitudeRef) giving the hemisphere. Altitude works the same way, with GPSAltitudeRef indicating above or below sea level. Well-implemented devices also write GPSDateStamp and GPSTimeStamp, which are recorded in UTC and are therefore sometimes more trustworthy than the local DateTimeOriginal — they come from the positioning system rather than the user-settable clock.

Two quality fields are worth knowing. GPSDOP records dilution of precision, and GPSHPositioningError — added in Exif 2.31 — records estimated horizontal error in meters. Where present, these tell you how much confidence the device itself had in the fix. Most consumer files omit them entirely.

Accuracy limits are real and frequently misunderstood:

• Phones usually do not report a satellite fix. They report a fused location derived from GNSS plus Wi-Fi network scanning and cell-tower data. Indoors, the coordinates may come entirely from a Wi-Fi lookup, which can be off by a considerable distance and can be wrong in ways that look precise.
• Urban environments degrade fixes. Signal reflection off buildings produces multipath error; a position in a dense city block can land on the wrong side of the street or the wrong building.
• A stale fix can be written to a fresh photo. If positioning is slow to acquire, a device may attach the last known location rather than the current one.
• Coordinates say nothing about which way the camera pointed. Some devices write GPSImgDirection, but many do not, and a coordinate alone cannot distinguish a photo of a building from a photo taken inside it.

Exif 3.0 updated the GPS tags to acknowledge multi-constellation positioning — GPS, GLONASS, Galileo, BeiDou, QZSS, and NavIC — which improves fixes in practice but changes none of the above.

What destroys EXIF

The most common way a photo loses its metadata is not deliberate tampering. It is ordinary handling.

• Screenshots. A screenshot is a new image rendered from the display. It carries the screenshot's own metadata, not the original photo's. The original date is simply gone, replaced by the moment you pressed the buttons.
• Messaging apps. Many chat platforms re-encode images on send to reduce size, and re-encoding commonly discards or rewrites metadata. Sending the same file as an explicit document or file attachment, where the app offers that, usually preserves more.
• Social platforms. Stripping metadata on upload has been standard practice across major platforms for years, partly for privacy and partly for storage. Behavior differs by platform and changes over time — never assume a downloaded copy retains anything.
• Re-saving in an editor. Opening and exporting through image software rewrites the file. Depending on the tool and its export settings, some tags survive, some are rewritten, and some vanish.
• Deliberate stripping at the OS level. Both iOS and Android let you remove location from a shared copy, and Windows offers a "Remove Properties and Personal Information" option in file properties. These are good privacy features and destructive to documentation.

The practical rule: send the original file, by a route that does not re-encode it, and keep an untouched copy yourself. Once a chain of custody passes through a screenshot, the metadata argument is over.

Why reviewers treat EXIF as corroboration, not proof

Insurance adjusters, opposing counsel, and compliance reviewers all approach photo metadata the same way: as circumstantial support that has to be consistent with everything else in the file, not as a standalone fact.

The reasoning is straightforward. Authenticating evidence generally requires showing that a thing is what its proponent claims it is, and a field that the proponent could have typed does not do much of that work by itself. US federal practice does provide certification routes for records produced by an electronic process and for digital files identified by hash — Federal Rules of Evidence 902(13) and 902(14), added in 2017 — but those depend on a qualified certification about the process, not on the bare presence of a tag inside the file. Rules and practice vary by jurisdiction and by forum, and none of this is legal advice.

What EXIF does do well is corroborate. When the timestamp, the GPS fix, the camera model, the lens, and the exposure settings are all mutually consistent, and consistent with the visible scene — sun angle matching the stated time, weather matching the stated date — the file becomes much harder to dispute. When they contradict each other, EXIF becomes evidence against the photo. That asymmetry is the honest summary: metadata rarely proves a photo, and frequently disproves one. Our guide on how to tell if a photo has been altered covers reading those contradictions in order.

How to inspect EXIF yourself

macOS. Open the image in Preview, then Tools → Show Inspector. The tabs there include a general info pane, an Exif pane with the camera and exposure fields, and a GPS pane with a map when coordinates are present. Finder's Get Info window shows far less; use the Inspector.

Windows. Right-click the file → Properties → Details. This shows a curated subset, not the full tag set. Note that the same dialog offers metadata removal, so be careful what you click on a file you intend to keep as an original.

iPhone. In Photos, open the image and tap the info button (or swipe up). You get the capture date and time, the device, basic exposure data, and a map if location was recorded.

Android. In Google Photos, open the image and swipe up or use the info button for a similar panel. Some manufacturers' gallery apps expose more detail than others.

Everything. For the complete tag set, including fields no OS viewer surfaces, the standard tool is ExifTool, an open-source command-line utility. Running it with grouped, short-form output — exiftool -a -G1 -s photo.jpg — dumps every directory in the file, including maker-specific blocks. It is the only way to see what is genuinely there rather than what an interface chose to display.

The gap this leaves

EXIF answers "what did the device record about itself?" It cannot answer "was this file altered after capture?" — because it is not bound to the pixels in any way. You can change the image and leave the metadata, or change the metadata and leave the image, and nothing in the file objects.

Closing that gap requires a different mechanism: a cryptographic signature applied at the moment of capture, bound to the actual image data, verifiable by anyone afterward. That is what the C2PA standard specifies, and it is worth understanding on its own terms — see Content Credentials explained. It is also the problem EtchImage exists to solve.

Until then, treat EXIF for what it is: genuinely useful context, written by a device you are asking someone to trust, in fields that anyone can rewrite.