Introduction to EXIF metadata

EXIF metadata is a standard used for image and audio file tags created by devices and applications. Most commonly, this kind of embedded metadata is associated with JPEG files. However, EXIF metadata is also present in TIFF, WAV, and other files. In JPEG files, EXIF metadata can contain technical camera settings used to take the photo as the shutter speed, F-stop, and ISO values.

These may not be inherently useful to an examiner, but tags containing the Make, Model, and GPS location of the photo can be useful for attributing an individual to a crime. Each of these elements are associated with a tag. For example, the "Make" metadata is EXIF tag 271 or 0x010F. A list of tags can be found at http://www.exiv2.org/tags.html.

EXIF metadata is stored at the beginning of JPEG images and, if present, is located at byte offset 24. The EXIF header begins with the hex 0x45786966, which is "Exif" in ASCII. The following is a hex dump of the first 52 bytes of a JPEG image.

Note...