Metadata and Its Limits

A man in an invented town called Stonebridge posted a video of a downed power line with the claim "filmed this morning." A reader opened the file's properties and noted a creation date three weeks earlier. The poster replied that the file had been "re-saved." Both were right. The date was a real piece of information, and it was also not decisive. Neither side had checked a second source.

That is the shape of most metadata disputes, and it is worth learning the shape before the tools.

What metadata is

Every digital file carries two things: the content (the pixels, the sound, the words) and a set of notes about the content. The notes are metadata. Some are written by the device automatically. Some are written by software. Some are typed by people.

EXIF in plain words

EXIF (exchangeable image file format) is the format most cameras and phones use to store notes inside a photo. It was originally defined by a Japanese standards group and is now maintained by two Japanese industry bodies, JEITA and CIPA. A photo's EXIF can include the make and model of the camera, exposure settings and the date and time, and, when the device has GPS and location access turned on, the latitude and longitude. A reference article on the format also notes that these tags are often recorded by default and without the user's awareness, which is why people share location by accident.

You can read EXIF with built-in tools: on Windows, right-click the file, choose Properties and open the Details tab; on a Mac, open it in Preview and choose the information panel. The free InVID-WeVerify plugin reads EXIF from JPEG images and metadata from MP4 and M4V videos, and links to a map when location data is present. Many free web viewers do the same. As with the image tools in lesson 3, avoid uploading private or sensitive photos to a website just to read them.

Why metadata is weak evidence

• It is easily stripped. Metadata sits in the file as an add-on. Many sites and apps remove or rewrite it on upload, for privacy and to shrink the file. Messaging apps often recompress pictures and drop details. The result is that honest files arrive empty. Jeff Pierson's free AVPrep converter has a metadata strip feature for people who want to remove location before posting.
• It is easily edited. Free tools can read and write EXIF values: the reference on the format names ExifTool, Exiv2 and Pillow as libraries that can write them. A date or camera name is a typed value, not a seal. Editing software also rewrites some of it when you simply open and save the file, and a reference on the format notes that most image editors damage or remove some EXIF data when saving.
• It may be wrong without anyone lying. A camera's clock may be set wrong, left in another country's time, or reset by a dead battery. Phones normally take time from the network, but not always.
• It may not mean what it seems. A document's created date can be the date someone copied an old template. A video's creation date can be the date it was exported, not shot.
• Absence proves nothing. The common case is no data at all.

The correct attitude: a metadata value is a claim made by the file. Check it against something that was not made by the file.

What happens on the way to you

The picture you are checking has been moved around. Each hop can change what is stored.

Because behavior differs by platform and changes with app updates, this table says "usually" and "often." The way to know for your own case is to take a photo with location on, upload it privately, download it and compare. Take that test once and you will have firsthand knowledge worth more than a generalization.

Document metadata

Office files and PDFs have their own notes. A Word file can show the author's name, who last saved it, when it was created and last modified, how many revisions, and the company field. A PDF can show the program that produced it. These can be useful: a memo said to come from a county office but whose author field shows a consumer app and a creation time after the meeting is worth a question. And they can mislead: the author is whoever's name was registered on the software, copied from a template or an earlier file.

For your own documents, check properties before sending a file outside the organization. Names of earlier authors, edit history and comments can travel with a file. In Word, the document inspector and a "save as PDF" step are the common ways to clear them. Details differ by program, so use the vendor's help page.

Timestamps and time zones

This is where good-faith checkers go wrong. A time without a zone is an incomplete statement.

• Older EXIF had no way to record a time zone. The standard's reference notes that before version 2.31 there was no way to record zones, and that a reader could misinterpret local time as UTC. Version 2.31 (July 2016) added offset tags that store an offset from UTC, for example plus or minus six hours. Exif 3.0 followed in 2023. This version history comes from a secondary reference (the Wikipedia article on Exif), so check the CIPA specification if you need to cite it. Many photos still lack the offset tags.
• Video files commonly record creation time in UTC. Your computer may show it converted to your local time, or not.
• Idaho spans two zones: most of the state is on Mountain time, and the northern panhandle (roughly north of the Salmon River) is on Pacific time. In October, before daylight saving time ends on the first Sunday of November (November 1, 2026), Mountain Daylight Time is UTC minus 6 hours and Pacific Daylight Time is UTC minus 7 hours.
• Websites show posting times in the zone of the viewer, the server or the poster. Check which.
• Wayback Machine addresses use digits for year, month, day, hour, minute, second. The Archive's help page gives the example 20000229123340 as February 29, 2000 at 12:33:40. Those times are generally read as UTC, but the Archive's help page does not state the zone, so confirm with the Archive before relying on the exact hour.

What metadata can and cannot prove

Questions and answers

Can I tell if a photo was edited from its metadata?

Sometimes a software field names an editing program, which is a clue. A clean file does not show it was unedited, because the field can be removed or rewritten.

Does my phone put my home address in photos?

It can put coordinates in them if location is allowed for the camera. Coordinates near your home can be mapped to your address. Check your camera's location setting, and strip location before posting publicly.

Do screenshots keep the original's location?

No. A screenshot is a new picture. It has its own time and device details and none of the original's camera data.

Why do two programs show different dates for one file?

Files can carry several dates: created, modified, accessed and, for photos, the time taken. Operating systems also add their own file dates when a file is copied. Compare the same field in both programs.

What is the safest way to receive an original photo?

By email as an attachment or through a file-transfer link that preserves the original. Messaging apps often recompress.

Can metadata be forged?

Yes. It is typed data, and free tools can change it. That is exactly why it cannot stand alone. This course does not teach how, only that you should assume it is possible.

Is there a way to make metadata trustworthy?

Not with ordinary EXIF. Content credentials are an effort to attach signed history to media; lesson 7 covers what they do and do not show.

Hard questions

If metadata is so weak, why bother?

Because contradictions are informative. A file whose properties conflict with the story is worth a second look, and a file that matches is at least not contradicted. The job is to use it as a prompt, not a verdict.

Should I remove metadata from everything I share?

For photos of private places, children and homes, yes, remove location before posting. For work you want to prove authentic later, keep the original untouched in your own records and share a stripped copy.

What if an official source says the metadata shows something?

Ask how they read it, with which tool, and whether the original file is available for independent review. Claims about metadata should be checkable by someone else.

Could an honest person have contradictory metadata?

Often. A wrong clock, a re-export, a time zone slip. Give the person a chance to explain and ask for another piece of evidence before drawing conclusions. That is fair and it is also how you avoid a wrong accusation.

What is the weakest point of this lesson's advice?

That it depends on your having the original file. Often you will not. When you only have a copy that has traveled, metadata is unavailable and you are back to tracing the earliest version and checking the scene against the record.