Every time you take a photo with a smartphone or camera, the image file holds more than just pixels. It also carries a set of invisible data, written automatically by the device: EXIF metadata. Capture date, camera model, settings, and sometimes GPS coordinates — this information tells the story of the image. For anyone trying to verify a photo's origin, knowing how to read it is a basic skill. But EXIF data also has its traps: it can be forged and is often erased. This guide explains in detail what it contains, how to view it, and how to interpret it without overstating its value.
What is EXIF metadata?
EXIF stands for Exchangeable Image File Format. It is a standard that defines how to store descriptive information inside an image file, mainly in JPEG format, but also TIFF and some RAW formats. Concretely, when a sensor records an image, the device writes a detailed technical sheet alongside it.
This data lives in the file header, separate from the pixels themselves. It is designed to travel with the image and lets a photo app, for instance, sort your pictures by date or location. But what serves user convenience serves forensic analysis just as well: EXIF is a first trace of provenance.
EXIF, IPTC, XMP: don't confuse them
People often speak of "metadata" loosely. In reality, several standards coexist:
- EXIF: technical data generated by the device (date, settings, GPS).
- IPTC: editorial information added manually (caption, author, copyright), historically used by the press.
- XMP: an Adobe format that can encompass and extend the previous two, often enriched by editing software.
For origin verification, EXIF is the most telling, because it is written by the machine at the moment of capture.
What EXIF actually contains
The richness of an EXIF sheet varies by device, but you typically find:
| Category | Example fields | What it reveals |
|---|---|---|
| Device | Make, model, serial number | Which hardware took the photo |
| Date and time | DateTimeOriginal, time zone | When the scene was captured |
| Settings | Aperture, shutter speed, ISO, focal length | Shooting conditions |
| Lens | Lens model, focal distance | Optical consistency |
| Geolocation | Latitude, longitude, altitude | Where the photo was taken |
| Software | "Software" field | Passage through an editor (Photoshop, etc.) |
| Orientation | Rotation, embedded thumbnail | Layout and preview |
The "Software" field, a valuable clue
Among all these fields, the one mentioning the software deserves special attention. If a photo supposedly straight out of a camera carries "Adobe Photoshop" in its Software field, it means it passed through an editor — without necessarily proving fraudulent manipulation. It is a signal to dig into, not a conviction.
Geolocation: useful but sensitive
Many smartphones record GPS coordinates in the EXIF. This is a goldmine for checking that a photo was indeed taken at the claimed location — but also a privacy risk, which is why many platforms strip it automatically.
The date: a field to handle with care
The DateTimeOriginal field is supposed to indicate the exact moment of capture. But beware: it depends on the device clock, which may be set incorrectly, and the time zone is not always recorded reliably. A photo taken in a different time zone, with a misconfigured device, or in burst mode, can show a misleading date with no fraudulent intent whatsoever. The EXIF date is a starting point, to be confronted with context rather than taken at face value.
The embedded thumbnail, a revealing detail
Many JPEG images carry a thumbnail in their metadata, generated at the moment of capture. Yet some editing software does not update this thumbnail after modification. In known cases, comparing the EXIF thumbnail to the main image revealed that a face or detail had been retouched: the thumbnail still showed the original. It is a perfect example of the unsuspected richness of metadata.
How to read an image's EXIF
Several paths are open to you, from simplest to most technical:
- Operating system properties: a right click then "Get Info" (macOS) or "Properties > Details" (Windows) already shows part of the EXIF.
- Viewers and photo software: Lightroom, the Photos app, or many tools display date, device, and settings.
- Online tools and dedicated utilities: they expose every field, including those hidden by consumer interfaces.
- Analysis platforms: a tool like TruthLens automatically extracts and interprets EXIF as part of a broader analysis.
The advantage of a specialized platform is that it does not merely display the fields: it puts them in perspective with the file's other signals. You can submit an image and get this complete reading in seconds.
Why missing EXIF is a signal — but not proof
This is one of the most misunderstood points. You often hear: "there's no EXIF, so it's an AI image." That is wrong, or at least very incomplete.
What the absence can mean
An image lacking any capture EXIF data may indeed have several origins:
- It was AI-generated: never having passed through a sensor, it has no native camera EXIF.
- It was screen-captured: a screenshot does not carry the original image's EXIF.
- It was re-saved by software that erased the metadata.
- It passed through a social network that stripped EXIF on upload.
Why it is not conclusive
This last point is essential: most major platforms (social networks, messaging apps, some mail services) systematically remove EXIF on upload, for privacy and optimization. As a result, a perfectly authentic photo, taken with a real camera, can reach you completely stripped of EXIF simply because it went through a story or a message.
Missing EXIF is therefore a clue to cross-check, never standalone proof. This is exactly the same logic as for Error Level Analysis and its false positives: no single signal decides.
EXIF and AI-generated images
The case of synthetic images deserves separate treatment, because this is often where people expect too much from EXIF.
An AI image has no capture EXIF
By construction, an image generated by a model (Midjourney, DALL·E, Stable Diffusion…) never passed through a physical sensor. It therefore has no native device data: no camera model, no lens settings, no capture GPS coordinates. This is consistent with its origin — but it is not enough to give it away, since a real photo stripped by a platform shows the same "empty" profile.
Some generators add their own metadata
Conversely, several AI tools now write metadata that reveals their involvement: a Software field mentioning the model, or above all a C2PA / Content Credentials manifest explicitly flagging AI generation. When present, these traces are a strong signal. But as always, they can be erased by recompression or a screenshot. Raw EXIF itself can even be fabricated to pass an AI image off as a camera photo — hence the need to cross-check with methods that cannot be forged as easily, such as image signal analysis.
The major limits of EXIF
Beyond absence, the EXIF that is present also has limits you must factor in.
It is easily forged
EXIF is not cryptographically signed (unlike what the C2PA standard offers). Anyone can, with a metadata editor, change the date, camera model, or GPS coordinates of a file. A "perfect" EXIF sheet is therefore no guarantee of authenticity: it may have been fabricated from scratch.
It is fragile
Conversely, it vanishes at the slightest processing: screenshot, recompression, upload to a platform, format conversion. Its survival depends entirely on the chain the file went through.
Toward verifiable provenance: C2PA
It is precisely to overcome these limits that the C2PA provenance standard was designed. Where EXIF is declarative and forgeable, the Content Credentials of the C2PA standard rely on a cryptographically signed manifest, far harder to counterfeit. The two approaches are complementary: EXIF informs, C2PA attests.
EXIF and practical verification: a concrete case
Imagine you receive by message a photo meant to prove a claim, an event, or a situation. How do you use the EXIF?
- Get the original file, not a screenshot or a re-shared version.
- Check the date: does it match the claimed time?
- Check the GPS if present: is the location consistent?
- Look at the Software field: did the photo pass through an editor?
- Note inconsistencies: a high-end camera but absurd EXIF, a date later than the events, etc.
- Cross-check with other methods: reverse image search, ELA, noise analysis.
This approach is detailed in our guide on how to verify a photo received by message or email, where EXIF plays a central but never exclusive role.
How platforms handle EXIF
Not all platforms treat metadata the same way, which complicates interpretation. Here are the broad trends observed:
| Platform type | Usual EXIF handling |
|---|---|
| Mainstream social networks | Near-systematic stripping (privacy, weight) |
| Messaging ("compressed" send) | Recompression and EXIF stripping |
| Messaging ("file / document" send) | EXIF often preserved |
| Cloud storage services | Generally preserved as long as you download the original |
| Email (direct attachment) | Usually preserved |
The practical lesson is crucial: to use EXIF, you must always retrieve the original file through the channel that preserves it. An image received "compressed" in a messaging app will often have lost its metadata, while the same one sent "as a document" will keep it. This distinction alone explains many false conclusions.
EXIF's place in the TruthLens pipeline
In a TruthLens analysis, EXIF extraction is only a first layer. It is confronted with C2PA, pixel-by-pixel ELA, AI vision, generator signatures, and PRNU. Everything leads to a certified report, sealed with a SHA-256 fingerprint and timestamped via OpenTimestamps, guaranteeing the analysis document is intact and admissible. No decision is made on the sole basis of an EXIF field.
Common myths about EXIF, debunked
A few persistent misconceptions are worth correcting head-on:
- "No EXIF means it's fake." False. Stripping is routine on most platforms; absence is a clue, not a verdict.
- "Rich EXIF means it's genuine." False. Every field is editable; a perfect sheet can be fabricated.
- "The EXIF date is the truth." False. It reflects a possibly misconfigured device clock and may lack a reliable time zone.
- "EXIF and C2PA are the same thing." False. EXIF is unsigned and editable; C2PA is cryptographically signed and verifiable.
Holding these four corrections in mind already puts you ahead of most informal "analyses" that circulate online.
Conclusion
EXIF metadata is the first window onto an image's history: it tells which device, when, where, and with what settings. Learning to read it is essential for any verification work. But its value is strictly conditional: forgeable on one side, fragile on the other, it only counts when cross-checked with other signals. An EXIF sheet is a testimony, not a verdict. Rigor means listening to it without believing it blindly — and confronting it with more robust methods, up to cryptographic provenance and the certified report.
FAQ
How do you view a photo's EXIF metadata?
The simplest way is to check the file properties through your system (right click then Get Info on macOS, Properties then Details on Windows). For an exhaustive reading, use a dedicated utility or an analysis platform like TruthLens, which extracts and interprets all fields, including those hidden by consumer interfaces.
Does missing EXIF prove an image is fake or AI-generated?
No. Many platforms strip EXIF on upload, and a screenshot erases it too. An authentic photo can therefore arrive with no metadata at all. Missing EXIF is a clue to cross-check with other methods, never proof on its own.
Can EXIF metadata be forged?
Yes, easily. EXIF is not cryptographically signed: a metadata editor lets you change the date, camera model, or GPS coordinates. A consistent EXIF sheet is therefore no guarantee of authenticity. It is to overcome this weakness that the C2PA standard relies on signed manifests.
What is the difference between EXIF and C2PA?
EXIF is descriptive data written by the device, unsigned and editable. C2PA is a provenance standard that attaches a cryptographically signed manifest, tracing the origin and modifications of a file in a verifiable way. EXIF informs about context; C2PA attests to provenance.