Chapter 20 — Key Takeaways

The big idea

Every photo, video, and document is two files at once — the content a person sees and the metadata almost nobody does — and the skill of this chapter is reading the second one with authority and stating its limits in the same breath. Metadata can answer the questions a case actually turns on: what device made this, when, where, and is it what it claims to be? But every one of those answers is editable in a single command and routinely stripped by ordinary handling, so a finding is never one field — it is a field corroborated across independent, harder-to-forge sources, presented as "what the file records," never as "what indisputably happened."

EXIF: the camera's testimony, read with both hands

  • A JPEG is markers and segments: SOI FF D8 → APP1 (the EXIF) → … → EOI FF D9; anything after FF D9 is not the image (carving and stego both live there).
  • The EXIF payload is a little TIFF block: byte order II (little-endian) / MM (big-endian), magic 42, chained IFDs, each a 2-byte count of 12-byte entries (Tag · Type · Count · Value-or-Offset). Offsets are measured from the TIFF header.
  • The tags that carry cases: Make/Model/Software, BodySerialNumber/LensModel, and the distinct timestamps — DateTimeOriginal (taken, local, no zone), CreateDate (digitized), ModifyDate (last modified), and GPSDateStamp/GPSTimeStamp (UTC). The local-vs-UTC gap recovers the timezone.
  • GPS is degrees/minutes/seconds rationals + a hemisphere ref → convert to signed decimal degrees (deg + min/60 + sec/3600, negative for S/W).
  • The IFD1 thumbnail is the chapter's dual-use star: a recovery lifeline when the full image is gone, and an integrity check when it disagrees with the visible picture.

The two-handed finding (memorize the tension)

Supports authenticity Demands caution
serial matches the seized device any tag editable with one exiftool command
DateTimeOriginal ↔ GPS-UTC consistent clock may be unset, wrong, or on the wrong zone
thumbnail matches the visible image social media strips EXIF entirely
Software = camera firmware, not an editor absence of EXIF ≠ forgery
quantization table matches the camera model presence of EXIF ≠ authenticity

Document metadata: who, when, and how

  • OOXML (.docx/.xlsx/.pptx) is a ZIP (PK 03 04): docProps/core.xml (dc:creator vs cp:lastModifiedBy, dates, revision), docProps/app.xml (Template, Company, TotalTime editing minutes), tracked changes and rsids, comments, and word/media/ images that carry their own EXIF.
  • Legacy .doc/.xls is OLE/CFB (D0 CF 11 E0 …): \005SummaryInformation streams, "fast save" deleted-text residue, a rolling last-ten-authors list.
  • PDF holds /Info and an XMP stream (which can disagree), and is modified by incremental updates appended after %%EOF — so counting %%EOF counts revisions, and "redacted" text under black boxes, pre-fill form data, and prior drafts often survive. Deleted ≠ destroyed.

Manipulation detection is a toolbox, not a button

  • Work cheapest first: metadata inconsistencies (editor Software, thumbnail mismatch, impossible timestamps) → ELA (a lead; edges/text/recompression glow innocently) → quantization / double-compression (sturdier than ELA) → clone (copy-move) and splice detection.
  • No single test proves a forgery. A defensible finding needs convergence across independent methods plus a plausible mechanism — and "consistent with editing but not established" is often the most honest conclusion.

Steganography & video (detection vocabulary)

  • Steganography hides existence (encryption hides only content). Detect, don't embed: data after FF D9/IEND, LSB statistics (chi-square), binwalk/zsteg/stegdetect/StegExpose. Steganalysis gives likelihood, rarely the payload.
  • Video: MP4/MOV are ISOBMFF boxes (ftyp, moov→mvhd/tkhd/mdhd with the 1904-epoch creation_time); AVI is RIFF; MediaInfo exposes the encoder fingerprint (Lavf/x264 = transcoded, not a camera original). I-/P-/B-frames and GOP structure lead into deepfakes (Ch. 35).

You can now…

  • ☐ Parse a JPEG's segments and its embedded TIFF/EXIF block by hand, and extract make/model/lens/serial/timestamps/GPS with ExifTool.
  • ☐ Convert EXIF GPS to decimal degrees and reconcile local capture time against GPS-UTC to recover a timezone — while stating EXIF's editability and clock/GPS limits.
  • ☐ Extract OOXML, legacy OLE/CFB, and PDF metadata, and recover prior revisions and "redacted" text from PDF incremental updates.
  • ☐ Apply a restrained manipulation toolbox (metadata, ELA, quantization/double-compression, clone/splice) and report each result as a corroborated lead, never standalone proof.
  • ☐ Detect likely image steganography structurally and statistically, and read MP4/MOV/AVI container metadata including the 1904-epoch creation time.

Looking ahead

Chapter 21 — Timeline Analysis. Every timestamp you gathered here — EXIF capture times, document created/modified dates — joins file-system MAC times, registry last-writes, and event-log entries in a single super-timeline (plaso/log2timeline), where the contradictions between clocks (including timestomping) reveal what really happened, and when.

One sentence to carry forward: The picture is what a person meant you to see; the metadata is what the file could not help recording — read both, trust neither without corroboration, and report exactly what each one proves.