Forensics on Digital Images – Worth More Than 1,000 Words
I used to carry a camera only on vacation. Now I carry the most powerful camera I have ever owned all the time…on my phone. I used to store my photos in a box in my attic. Now all my photos stay on my phone forever.
If a physical photo is worth a thousand words, a digital photo is worth more than that especially for a digital forensics examiner.
The additional value comes in the form of “metadata” that offers a treasure trove of information about the image for digital forensics examiners. Image files have a specific type of metadata that uses the acronym “EXIF”. EXIF stands for “exchangeable image file format”. Name an image file type and it probably has EXIF data: JPEG, PNG, JPG, TIFF, GIF, etc.
A recent phone upgrade reminded me of how much information this EXIF data contains and how powerful it can be. I was looking through the images that had been transferred to my new phone and saw the image below:
I took this picture with my phone several years ago while visiting San Francisco. I have no idea what the date or time was, which phone I used, nor do I remember where in the city this was, but my forensic instincts tell me I can find out. I took a peek at the EXIF data contained within this image and found some interesting stuff:
Create Date/Time: October 3, 2011 11:16:19
Make: Apple
Model: iPhone 3GS
GPS Altitude: 34.9 m Above Sea Level
GPS Position: 37 deg 47′ 24.00″ N, 122 deg 24′ 44.40″ W
This image was taken with my iPhone 3GS, was then transferred to my iPhone 5, then to my iPhone 6, and then to my iPhone 7. After several years and several migrations, the image EXIF remained intact and I can now use it to determine things about the image that I had completely forgotten or didn’t know.
Using the GPS coordinates I was able to locate the fire hydrant at the corner of Taylor St and Bush St in San Francisco. I took a screen shot from Google Maps to prove it:
Now, imagine how useful this information might be in an investigation or litigation case. Also, this is not a complete list of metadata that can be obtained from images, it’s just the most interesting.
If you need help with your digital evidence, CONTACT FLASHBACK DATA. We’re experts in digital forensics for law enforcement and attorneys, and our turnaround time is a fraction of what you’ll find at RCFL or any state lab.
