EXIF
Definition
Exchangeable Image File Format: a binary metadata standard defined in the IFF/TIFF structure embedded in JPEG APP1 segment and TIFF file headers. Records capture parameters (shutter speed, aperture, ISO, focal length), timestamps, GPS, and device information.
- Full name
- Exchangeable Image File Format
- Structure
- Binary metadata in IFF/TIFF format
- Location
- JPEG APP1 segment or TIFF file header
- Records
- Capture settings, timestamps, GPS, device information
Common questions
Why is EXIF data valuable in digital forensic investigations?+
It can place an image at a specific time and, if GPS data is present, a specific location, and can reveal the capturing device's make and model, all of which help establish provenance or corroborate a suspect's or witness's account.
Can EXIF metadata be altered without detection?+
Yes, EXIF fields can be edited with common software, so investigators should not treat metadata as automatically reliable and should corroborate it with other evidence, such as file system timestamps or independent location data, when it matters to a conclusion.
Related terms
- IPTC IIM
- International Press Telecommunications Council Information Interchange Model: a legacy binary metadata standard embedded in JPEG APP13. Carries caption, credit, copyright, and editorial...
- Makernote
- A proprietary EXIF sub-block written by the camera manufacturer to record device-specific data not covered by the EXIF standard. Canon, Nikon, Sony,...
- Moov Atom
- The master index atom in an MP4 or MOV file. Contains all track sample tables, timing information, creation and modification timestamps, and...
- RIFF Chunk
- Resource Interchange File Format: the container structure used by WAV and AVI files. A hierarchy of typed chunks, each with a four-character...
- XMP
- Extensible Metadata Platform: Adobe's XML-based metadata container embedded as a text packet in image files. Can carry all standard EXIF and IPTC...