What can photographs and their metadata show?¶
title: What can photographs and their metadata show? subtitle: They may show visual content, file history, device information and embedded location—but metadata can be changed, removed or created by another system. slug: what-can-photographs-and-their-metadata-show series: mobile-extraction-and-reader-reports section: interpreting-common-artefacts card_type: question_card content_type: core-operational risk_level: normal pathway_order: 35 section_order: 10 status: draft owner: IF Digital last_updated: '2026-07-25' version: '0.1' review_gate: pending review_mode: ai-assisted review_timebox_mins: 30 qa_gate: pending qa_count: 0 pipeline_ref: PIPELINE_PRG_001 pipeline_version: '1.1' public_safe: true video_ready: true word_count: 500 estimated_read_time_seconds: 207 audiences: - investigator - supervisor - fraud and compliance practitioner tags: - mobile evidence - photographs - metadata - EXIF - location sources: - title: SWGDE Best Practices for Mobile Device Forensic Analysis url: https://www.swgde.org/documents/published-complete-listing/20-f-005-swgde-best-practices-for-mobile-device-forensic-analysis/ - title: 'NIST SP 800-101 Rev. 1: Guidelines on Mobile Device Forensics' url: https://csrc.nist.gov/pubs/sp/800/101/r1/final - title: 'Apple Support: Browse photos and videos by location on iPhone' url: https://support.apple.com/en-gb/guide/iphone/iph390138909/ios - title: 'Google Photos Help: Understand, find and edit your photos'' locations' url: https://support.google.com/photos/answer/6153599?hl=en-GB - title: 'Google Photos Help: Learn about information stored on your photos' url: https://support.google.com/photos/answer/15532903?hl=en-GB
What can photographs and their metadata show?¶
They may show visual content, file history, device information and embedded location—but metadata can be changed, removed or created by another system.
Script¶
A photograph can provide two broad types of evidence.
The visible image.
And the metadata or file history associated with it.
Keep those separate.
The visible content may show a person, object, document, place, screen, vehicle or event.
It may contain text, reflections, landmarks, clocks, weather, shadows or other contextual clues.
Those observations come from the image itself.
Metadata may include:
capture date and time;
camera make and model;
dimensions;
orientation;
software;
location coordinates;
file name;
creation and modification times;
and descriptive fields.
Some photographs contain embedded GPS information when the camera had location access.
Apple and Google both explain that photo location may come from camera metadata, a manually added location or an estimated location created by the photo service.
Those are not the same source.
Check whether the location is embedded in the original file or added by an application.
Metadata is useful.
It is not immutable.
It can be edited, removed or rewritten by applications, messaging services, social platforms and image editors.
Google notes that descriptive metadata can be modified.
A shared image may lose location data.
A screenshot may inherit the screenshot time rather than the time shown in the captured content.
A cloud service may create a derivative copy.
Start by identifying the file type and source.
Is this the original camera file?
An edited version?
A screenshot?
A downloaded image?
A messaging attachment?
A thumbnail?
A cloud-synchronised copy?
A photograph saved from another person may carry their camera metadata or no metadata at all.
The presence of the file on the handset does not prove the handset camera created it.
Compare hashes and dimensions where appropriate.
An original and thumbnail may depict the same image at different sizes.
Edited versions may preserve some metadata and change other fields.
A message database may link the media file to a sender, recipient and time.
That relationship may be more informative than the file metadata alone.
Time needs care.
A photo can have capture, file creation, modification, import, download and synchronisation times.
The earliest visible time is not automatically the capture time.
Timezone handling and incorrect device clocks can also affect interpretation.
Location also needs corroboration.
An embedded GPS coordinate may support where the camera recorded the image.
It does not prove who held the camera.
A manually added or estimated location is weaker evidence of capture position.
The common mistake is:
“The photograph was on the phone, so the owner took it.”
The file may have been received, downloaded, restored or synchronised.
Another mistake is:
“The EXIF time is the exact time the event happened.”
It may be the device’s recorded capture time and may depend on its clock and timezone.
A careful conclusion might say:
“This original-format image contains embedded camera metadata recording capture on this device model at this time and coordinates. The same file is linked to the handset camera folder.”
Then explain the human attribution separately.
Photographs combine visual and technical evidence.
Use both, but identify the source and limitations of each.
Key takeaway
Separate what the image visibly shows from what its metadata records, and establish whether the file is an original, copy, edit, thumbnail or synchronised item.
Related questions¶
- What can location records show?
- What can cached or thumbnail images show?
- Could cloud-linked data have come from another device?
Source notes¶
- SWGDE Best Practices for Mobile Device Forensic Analysis
- NIST SP 800-101 Rev. 1: Guidelines on Mobile Device Forensics
- Apple Support: Browse photos and videos by location on iPhone
- Google Photos Help: Understand, find and edit your photos' locations
- Google Photos Help: Learn about information stored on your photos