0

Using Exiftool, is there a way to check whether the image has been modified in any way, by say, comparing the dates in EXIF data?

I was thinking something along the lines of comparing shooting date with some of the other dates, but am not sure which would be a good reference for something like this?

If anyone has done something like this, and is willing to offer some advice, it would really be welcomed.

Currently reading the help data file...

Need to add, what I am asking is purely for personal use. I'm not interested in detecting modified/"faked" photos or such, but would just like to have a way of detecting which of the photos in the folder came from the camera, and which I've modified in some way (usually contrast, color levels...).

Rook
  • 1,457
  • 5
  • 18
  • 29
  • What do you mean by "check whether the image has been modified" ? What kind of modification would you like to detect ? Do you have an image of reference ? – Olivier Aug 23 '15 at 13:48
  • possible duplicate of How can I tell if a photo is real or faked? – mattdm Aug 23 '15 at 18:08
  • @Olivier - Need to add, what I am asking is purely for personal use. I'm not interested in detecting modified/"faked" photos or such, but would just like to have a way of detecting which of the photos in the folder came from the camera, and which I've modified in some way (usually contrast, color levels...). – Rook Aug 24 '15 at 00:06
  • @Idigas, that is important to know :) you should indeed be ok with metadata then – Olivier Aug 24 '15 at 05:35
  • 1
    In that case, this primarily hinges on whether the software you used to modify the files modifies the metadata, and if so, how. – mattdm Aug 25 '15 at 17:10
  • @mattdm - I don't know. I haven't modified it, and whether the software modifies it somehow, I'll have to look into. – Rook Aug 25 '15 at 19:43

3 Answers3

4

No, whoever modified the file can also modify the file modification date and all the EXIF data.

Also the file modification /creation date can be reset by e-mailing it or downloading it from the web.

Basically, if whoever gave you the file want to hide the modification exiftool is not powerful enough to help (and if the modification isnt hidden just asking is more reliable then looking for accidental metadata changes)

Nir
  • 20,825
  • 4
  • 38
  • 74
-1

There is an exif tag for modify date; I am not exactly sure what triggers it, but I think it's any modification of exif (not IPTC, XMP, MakerNotes) data.

There are lots of dates associated with an image file. You could compare any or all of them. Just do "exiftool -G" on an image and then look around for dates.

211Oakland
  • 513
  • 2
  • 2
  • 1
    There isn't anything that triggers it. As with all metadata internal to the file, it has to be set by the program. If the program used to edit the file doesn't alter it, it doesn't change. – StarGeek Aug 24 '15 at 17:01
-1

You could use a checksum, but storing that in the file is problematic. A separate SHA1 file in the directory with the files can be used for detecting corruption. It will also detect edits.

If you make the files read-only after copying them to the directory, it will make sure you don't trivially save over them.

JDługosz
  • 4,382
  • 1
  • 19
  • 38