Secret editing of EXIF data for photographs using freeware

EXIF Info wrote:
Can you give me advice on how best to modify EXIF info for digital photos
so that it is hard for a recipient to immediately know that the EXIF data
was modified?

Here is the manual procedure I use today to replace/modify EXIF data:
0) Starting with known good EXIF data in a jpg file called "old.jpg".

1) Replace the exif data: c:\ jhead -te old.jpg new.jpg

So as not to trip up with the EXIF size information, I reset it:
2) Reset image size data: exifer: EXIF/IPTC-Update EXIF image size values

Likewise with the EXIF thumbnails (which trip up a lot of people):
3) Remove old exif thumbnail: exifer: EXIF/IPTC-Thumbnail-Remove
thumbnail
4) Create new exif thumbnail: exifer: EXIF/IPTC-Thumbnail-Create
thumbnail

But, what else am I missing that will be a tell tale sign that the EXIF
data was modified? Am I missing anything obvious that will trip me up?

For example, how/should do I modify those other telltale EXIF info fields?
* ShutterSpeedValue
* SubjectDistance
* ImageNumber
* OwnerName
* Software
etc.

The best way is to strip these data out. Many image handling programs
don't even attempt to save them, and those which know how to usually
have the option to strip them.

Making fake data is harder, some points to consider:

- camera make/model:

- you have to find the actual string used by the target model (which
may be different depending on continent).

- for SLRs, some makes (Nikon, at least) include technical data on
the lens used: min/max focal length and associated apertures.

- other data should be compatible with that different model:
original image size and aspect ratio, ISO, aperture, speed, focal length
and focal length/equivalent 35mm focal length ratio (physical sensor
size), flash mode, various data (scene mode), exif version, and possibly
the format of some fields.

- date/time/position:

- should be reasonably consistent with picture (lighting and sun
position, weather...)(and this is in several places).

- With GPS one can check things out on GoogleEarth (it is even
possible to crosscheck these mountains in the background)

- technical shoot data:

- an expert eye will have a rough idea of the focal length used. You
can cheat a bit there, though (1.5x both sides), but if you have the
subject distance in the Exif, it will be harder. I don't know if DSLRs

- you have to remain within a reasonably consistent set of values
for focal length, aperture, sensor size, and depth of field (and of
course camera/lens)

Good luck :-)






















[Image]
Make = Panasonic
Model = DMC-FZ8
Orientation = top/left
Software = Ver.1.0
Date Time = 2007-08-18 10:43:36

[Camera]
Exposure Time = 1/200"
F Number = F5
Exposure Program = Normal program
ISO Speed Ratings = 100
Exif Version = Version 2.21
Date Time Original = 2007-08-18 10:43:36
Date Time Digitized = 2007-08-18 10:43:36
Exposure Bias Value = ±0EV
Max Aperture Value = F2.83
Metering Mode = Pattern
Light Source = Fine weather
Flash = Flash did not fire, compulsory flash mode
Focal Length = 55.2mm
Maker Note = 6786 Byte
Flashpix Version = Version 1.0
Color Space = sRGB
Exif Image Width = 3072
Exif Image Height = 2304
Sensing Method = One-chip color area sensor
File Source = DSC
Scene Type = A directly photographed image
Custom Rendered = Normal process
Exposure Mode = Auto exposure
White Balance = Manual white balance
Digital Zoom Ratio =
Focal Length In 35mm Film = 331mm
Scene Capture Type = Normal
Gain Control = None
Contrast = Normal
Saturation = Normal
Sharpness = Normal

[Thumbnail Info]
Orientation = top/left

[Thumbnail]
Thumbnail = 160 x 120







--
Bertrand

EXIF Info wrote:
On Thu, 26 Jun 2008 10:46:26 +0200, Ofnuts wrote:

Making fake data is harder, some points to consider:
Exactly the point! The false EXIF data needs to roughly match the
photograph! But how?

- date/time/position:
- lighting and sun position
Good point to check the shadows for outdoor shots to see if they match with
the time the picture was falsly taken. I'll add this to my checklist.

- an expert eye will have a rough idea of the focal length used.
- if you have the subject distance in the Exif, it will be harder.
Yes indeed! This is the type of observation I was looking for.
I try to change the EXIF subject distance to match the photograph but I
didn't think about the focal length having to match. Are you sure an expert
could guess the focal length from a photograph?

I'm far from an expert and I can usually tell if the picture was taken
with a 35 or 50mm lens (35mm equiv. of course). How goof experts really
are is your guess.

- you have to remain within a reasonably consistent set of values
for focal length, aperture, sensor size, and depth of field (and of
course camera/lens)

Sensor size? Hmmmmmm.... From any given photograph, how would "sensor size"
be obvious to a trained observer? I don't know how to fake sensor size.
What would be rough estimation points for the falsified EXIF?

Because the sensor size has a great influence on the DOF. A small sensor
at 2.8 (P&S, bridge) has the same DOF as an APS/C sensor several f-stops
higher (how much is "several" is a matter of actual sensor size, but
IIRC on the 4/3 sensor (which is not that much smaller than an APS/C)
you already have to open 2 f-stops more to achieve the same DOF).


--
Bertrand