Forensic Value of Exif Data: An Analytical Evaluation of Metadata Integrity across Image Transfer Methods

Abstract

Exif metadata contained in digital photographs is an important forensic resource, offering authentic information like timestamps, geolocation, and device identifiers. The research assesses the integrity of Exif information on various methods of image transmission, such as USB, email, and messaging platforms like WhatsApp, Telegram, Signal, Instagram, Facebook Messenger, and Snapchat. With the controlled image dataset of Android, iOS phones, and the Flickr Creative Commons collection, we examined metadata preservation using forensic software (Magnet AXIOM, FTK, XRY, ExifTool). Document-based modes and direct transfers (USB, email) maintained all Exif fields and file hashes, providing forensic integrity. Chat/image-based transfers, fueled by compression, effectively remove metadata, changing the file integrity. These results emphasize the necessity of platform-aware evidence handling in order to preserve metadata integrity during digital forensic examinations.

Keywords

Digital forensics / Exif metadata / Image authentication / Metadata integrity / File hash verification

Author Contributions

Conceptualization, methodology, software, validation, formal analysis, investigation, resources, data curation, writing—original draft preparation, writing—review & editing, visualization, supervision, and project administration: N.S.

Ethics Statement

Not applicable, as this study did not involve humans or animals.

Informed Consent Statement

Not applicable, as this study did not involve humans.

Data Availability Statement

The data that support the findings of this study are available from the corresponding author upon reasonable request.

Funding

This research received no external funding.

Declaration of Competing Interest

I declare no known competing financial interests or personal relationships that could have influenced the work reported in this paper.

References

[1] Soni N, Kaur M, Aziz K. Decoding digital interactions: An extensive study of TeamViewer’s forensic artifacts across Windows and Android platforms. Forensic Sci. Int. Digit. Investig. 2024, 51, 301838. doi:10.1016/j.fsidi.2024.301838.

[2] Soni N, Kaur M, Bhardwaj V. A forensic analysis of AnyDesk remote access application by using various forensic tools and techniques. Forensic Sci. Int. Digit. Investig. 2024, 48, 301695. doi:10.1016/j.fsidi.2024.301695.

[3] Soni N. Forensic analysis of WhatsApp: A review of techniques, challenges, and future directions. J. Forensic Sci. Res. 2024, 8, 019-024. doi:10.29328/journal.jfsr.1001059.

[4] Gangwar A, Pathania S. Authentication of digital image using Exif metadata and decoding properties. Int. J. Sci. Res. Comput. Sci. Eng. Inf. Technol. 2018, 3, 1-7.

[5] Sandoval Orozco AL, Arenas González DM, García Villalba LJ, Hernández-Castro J. Analysis of errors in Exif metadata on mobile devices. Multimed. Tools Appl. 2015, 74, 4735-4763. doi:10.1007/s11042-013-1837-7.

[6] Nayerifard T, Amintoosi H, Ghaemi Bafghi A, Dehghantanha A. Machine learning in digital forensics: A systematic literature review. arXiv 2023, arXiv:2306.04965.

[7] Bhagtani K, Yadav AKS, Bartusiak ER, Xiang Z, Shao R, Baireddy S, et al. An overview of recent work in media forensics: Methods and threats. arXiv 2022, arXiv:2204.12067.

[8] Buchholz F, Spafford E. On the role of file system metadata in digital forensics. Digit. Investig. 2004, 1, 298-309. doi:10.1016/j.diin.2004.10.002.

[9] Patel D, Sharma P. Meta data as a part of digital forensic investigation. Int. J. Sci. Res. Dev. 2015, 3, 812-814.

[10] Machado J. EXIF Metadata—Privacy and Security. ResearchGate. Available online: https://www.researchgate.net/publication/365411189_EXIF_Metadata_-_Privacy_and_Security (accessed on 28 December 2024).

[11] Conner KR. Ethical Issues Concerning Metadata. Holland & Knight Insights. Available online: https://www.hklaw.com/en/insights/publications/2006/03/ethical-issues-concerning-metadata (accessed on 28 December 2024).

[12] Magnet Forensics. Magnet AXIOM [Computer Software]. Magnet Forensics. Available online: https://www.magnetforensics.com/products/magnet-axiom/ (accessed on 10 April 2025).

[13] MSAB. XRY [Computer Software]. MSAB. Available online: https://www.msab.com/products/xry/ (accessed on 10 April 2025).

[14] Exterro. Forensic Toolkit (FTK) 8.0.0 [Computer Software]. Exterro. Available online: https://www.exterro.com/ftk-product-downloads/forensic-toolkit-ftk-8-0-0 (accessed on 10 April 2025).

[15] Harvey P. ExifTool (Version 12.50) [Computer Software]. Available online: https://exiftool.org/ (accessed on 10 April 2025).