What metadata might a mobile photograph contain?¶
A mobile photograph may contain metadata describing the file and how it was created.
What this means¶
Possible fields include date and time, device make and model, image dimensions, orientation, camera settings, software used and GPS coordinates.
The file system may also record creation, modification or access times.
This information can help link the image to a device, place it in a timeline or identify whether editing software was involved.
But metadata is not guaranteed to be present or accurate.
Messaging apps, social-media platforms and screenshots may remove or rewrite it.
Cloud services may change timestamps during synchronisation or download.
Editing can also alter fields.
A copied photograph may retain the original camera metadata even though it arrived on the current phone later.
The date recorded inside the image may differ from the date the file was saved to the device.
Time zones and incorrect device clocks can create further confusion.
The operational takeaway is: photograph metadata can support device, time and location analysis, but it must be interpreted in context and corroborated because it can be missing, changed or inherited.
What to check or do next¶
- Investigators should preserve the original file where possible and record how it was obtained.
- Do not rely on a screenshot of the photograph if the original file and metadata are available.
- Compare metadata with file-system records, cloud history, message context and other evidence.