What metadata might a mobile photograph contain?¶

Photograph metadata is the extra information stored with an image file. It can give you useful leads about when the image was created, what device or software was involved, and sometimes where the camera was when it was taken.

The important first question is not “does it have GPS?” It is what file am I actually looking at, and how did it get here?

An original camera image may contain rich metadata. A copy sent through a messaging app, downloaded from social media or saved from a cloud service may contain much less — or may carry information inherited from the original file.

What might you actually find?¶

A mobile photograph can contain fields such as:

Metadata	Why it may be useful
Date and time	Helps place the image in a timeline
Device make and model	May help link the file to a particular type of handset or camera
GPS coordinates	May give you a location to test
Image dimensions and orientation	Can help distinguish originals, edits and derivatives
Camera settings	May support the way the image was captured
Software	May show that another application processed or exported the file
Filename and storage path	Can help work out where the image came from on the device
File-system times	May show when that particular copy was created, modified or saved

You may also see EXIF data — a common set of metadata fields used by cameras and image software.

A simplified example might look like:

That is immediately useful. You now have a time, a device type and a location to compare with the rest of the investigation.

The original file matters¶

This is worth getting right early.

If somebody sends you a screenshot of a photograph, you are looking at a new image of the old image. Most of the original metadata may be gone.

The same can happen when images pass through messaging apps, social-media platforms, editing tools or cloud downloads. Some services strip metadata; others rewrite or preserve parts of it.

So if the original image file is available, preserve that rather than relying on a screenshot, preview or exported copy.

Could a photograph have arrived through an app or cloud service? is the useful next page if you need to work out how the file reached the handset.

Be careful with the time¶

A date inside the photograph and a file-system date are not necessarily the same thing.

For example:

• the image may have been taken on Monday;
• copied to another phone on Wednesday;
• edited on Thursday; and
• downloaded from cloud storage on Friday.

You could therefore see several perfectly genuine timestamps describing different events.

If the exact time matters, work out what each timestamp represents before putting it into your timeline.

Time zones and an incorrect device clock can also shift the apparent time.

GPS can be a very useful lead¶

If the file contains coordinates, map them.

They may put the image near a relevant address, road, venue or other location and give you an excellent line of enquiry.

But use them as something to test rather than the whole answer. Coordinates can be inaccurate, edited, inherited from another copy or based on a device position that was not as precise as the number of decimal places makes it look.

Does photograph metadata prove where the photograph was taken? goes into that question in more detail.

Device details can help with provenance¶

If the metadata says the image was created by a particular phone model, that may help when you already have a candidate device.

Compare it with:

• the seized handset model;
• surrounding photographs;
• cloud or backup history;
• file paths;
• message or download records; and
• any other image versions you have.

A photograph found on a Samsung handset that says it was created by an iPhone does not make it useless. It tells you to ask how it arrived on the Samsung.

That may lead you into messaging, cloud sync, another device or another person.

Does a photograph on a phone prove the user took it? deals with that attribution question directly.

Editing can leave useful traces too¶

Metadata may show that software handled the image after capture.

That does not automatically mean anything improper happened. Normal gallery apps, cloud services and image editors can all rewrite files.

What it gives you is another question:

Is this the original image, or a later version?

If that distinction matters, compare the available versions, dimensions, metadata, filenames and storage history. Edited photographs can retain useful original evidence, but you need to understand the file lineage.

What should you preserve?¶

When the metadata matters:

• keep the original file where possible;
• record exactly where it came from;
• keep the extraction or source reference;
• preserve any other versions of the image;
• record the metadata as found rather than relying only on a screenshot of it; and
• compare it with the device, cloud, message and real-world evidence around it.

The practical point is that photograph metadata can give you some excellent leads very quickly. It may point you towards a time, place, device or earlier version of the image.

Just make sure you know which copy you are looking at before you build too much around it.