What can a photograph on a mobile device prove?¶

At minimum, it can establish that an identified image file was present in a device or account under recorded conditions; origin, photographer, time and place require more evidence.

Images arrive through many routes¶

The handset may capture the photo, or receive it through messaging, email, download, backup, cloud sync or a linked device. Folder and filename are clues rather than proof. Metadata can be missing, inherited or altered.

Test provenance and content¶

Preserve the original file and acquisition method. Compare metadata, device and cloud history, surrounding images, messages, CCTV, landmarks, witnesses and location. The image may depict a real, staged, edited or screen-captured scene.

Photograph metadata provides another source for testing device, time and location, but it still needs provenance and corroboration.