Question about Exif Data on Jpegs & Forensic Limitations

I was referred here by Irongeek on one of his tutorials about Exif data. I was hoping someone here could help me with this question.

Regarding Exif data on Jpeg photographs, specifically the "picture being taken day" -- What are the forensic limitations on the 'picture being taken day?'

When and how can this data be changed? Is it ever changed automatically when editing the photograph, resizing, making a caption or sidebar, etc...If the Jpeg photo says photoshop 3, and has a picture being taken day of say 6/1/2010, is it possible that the 'picture being taken day' is wrong or not the actual day the picture was taken?

What does it mean exactly when a picture has a digital stamp saying 'picture being taken day' as 6/1/2010?

I have more questions but this will head me in the right direction as a good start.

Thanks,
Phil :)

I'm fairly sure this can be done with GIMP. You just have to say so when saving the jpeg file using GIMP. Can anyone else verify this? I'll check myself when I have more time.

I am really looking for the forensic limitations of Exif & Metadata;

1. Can the Exif/Metadat data be changed manually in photoshop 3?
2. Is it changed automatically when certain edit functions are used? I speak here of the picture being taken day especially.
3. Is it possible to add captions and other data to the picture without the picture taken day being changed?
4. What are the forensic limitations of Exif/Metadata?

Thanks-
Phil

Hi Phil,

Can you give me an example................or PM me so that I can give you an e-mail that accepts attachments up to 10 meg?

:)

Nihil,

Sure thing, I'll PM you in just a few minutes. Thanks for your help! Just please keep what I send you confidential.

Cheers-
Phil :)

Nihil,

I sent you a picture in your pm,...

Thank you,
Phil :)

Hi Phil-

I'm sure Nihil has already helped, but shoot me a pm if you have any other questions. There is actually a lot that can be done to manipulate EXIF data.

1100,

Thanks for the offer! I sent you a picture I have questions about. Hopefully I can find out everything I need to know about Exif data and metadata here.

Thanks for your help!

Cheers-
phil :)

Is there anyone else who knows everything about exif metadata and would like to help me out. I was hoping to have had my answers days ago and still haven't gotten the information I needed. There has to be someone out there who knows everything there is about Exif/Metadata and Adobe photodhop 3 and would like to share...

Anyone?

Thanks,
Phil :)

Phil- Check PM

Also, Nihil, et al. Can we get this moved to Computer Forensics?

Thread moved:)

Basically EXIF data is for photographers to troubleshoot their pictures..........it has no forensic relevance as it does not record amendments, and is not secure.

You can preserve some of the data such as the date, but you have to make a conscious effort to do this, and could never prove it.

It is nothing like the metadata that might be attached to a Microsoft Office document, for example.
EDIT:

The dates seem particularly irrelevant. I downloaded the sample and it reverted to my system date. When I make a copy (save as) it gives the new image the current system date. That implies that any form of editing that would require a save will change the image EXIF date.

This does sort of make sense as EXIF is not a forensics tool. It is to assist with photo editing and troubleshooting. Obviously, in that situation you are only interested in the last settings that apply to the image you are currently looking at, as they are the ones that have produced it.

Given that World + dog can alter the clocks in their cameras and computers I don't see much forensics value in that image date. Also remember that photographs can be scanned to produce a digital image, so the image date might bear absolutely no relationship to the actual photographic event.