Can Metadata Prove a Photo or Video Is Genuine?
First Published: 29th of September, 2026 | Last Updated: 29th of September, 2026
Photographs and video recordings are increasingly relied upon as evidence in criminal, civil and family proceedings. When the authenticity of a digital file is disputed, one of the first things considered may be its metadata.
Metadata can provide valuable information about a photograph or video, potentially including when it was created, the device or software involved, technical encoding information and whether the file has subsequently been processed.
However, metadata should not be treated as a digital certificate of authenticity.
A file containing apparently consistent metadata is not necessarily genuine, while missing or unusual metadata does not necessarily mean that a file has been manipulated. Forensic interpretation requires the metadata to be considered alongside the file structure, media content and circumstances in which the evidence was obtained.
What Is Metadata?
Metadata is information stored within or associated with a digital file that describes aspects of that file.
Depending on the file type and the device or software responsible for creating it, metadata may include:
creation and modification dates;
camera or smartphone make and model;
image dimensions and orientation;
GPS location information;
frame rate and video resolution;
codec and encoding information;
software or application identifiers; and
other information concerning how the file was created or processed.
For photographs, this information is often associated with EXIF and other metadata structures. Video files can contain several layers of metadata within their container and encoded media streams.
The information available varies considerably between devices, applications and file formats.
Can Metadata Prove That a Photograph or Video Is Original?
Not by itself.
Metadata can provide evidence that is consistent with a particular account of how a file was created, but its evidential significance depends upon the circumstances.
For example, a photograph may contain metadata identifying a particular smartphone model and a date and time that correspond with the alleged circumstances of capture. These observations may support the proposition that the photograph originated from that type of device at around the stated time.
They do not, however, independently prove that everything depicted in the photograph is genuine or that the file has never been altered.
Metadata fields may be changed, removed or rewritten. Some information can also change during completely legitimate processes such as copying, exporting, uploading or sharing a file.
Forensic examination therefore involves more than simply reading the properties displayed by Windows, macOS or a metadata-viewing website.
Can Metadata Be Changed?
Yes.
Some metadata can be modified deliberately using readily available software. Other metadata may change automatically as part of normal file handling.
For example, a photograph or video may be:
exported from an application;
downloaded from cloud storage;
sent through a messaging service;
uploaded to social media;
converted into another format;
edited using image or video software; or
copied between storage systems.
These processes can alter, remove or introduce metadata without necessarily altering the visible content.
Conversely, editing software may leave metadata indicating that particular software has interacted with a file. This can be relevant, but it does not automatically establish that the evidential content was manipulated.
The significance of a metadata entry depends upon what created it, how it would ordinarily arise and whether it is consistent with the rest of the evidence.
What Can a Forensic Examination Look For?
Where the authenticity or provenance of a photograph or video is disputed, a forensic examiner can consider several sources of information rather than relying upon a single metadata field.
These may include:
Metadata consistency
Different metadata fields can be compared to determine whether they provide a coherent account of the file's history.
An unexpected discrepancy may warrant further investigation.
File structure
Digital photographs and videos have underlying structures determined by their formats, recording devices and processing software.
The structure of a file may provide information about how it was generated or subsequently processed.
Encoding characteristics
Video and image compression can leave technical characteristics associated with particular encoding processes.
These characteristics may assist in determining whether the file is consistent with direct capture or has undergone subsequent processing.
Device and software information
Where identifiers relating to a device, application or software package are present, their significance can be assessed in the context of the complete file.
Visual or temporal anomalies
The actual media content may also be examined for features potentially associated with manipulation, discontinuities or other processing.
No single observation should necessarily be considered in isolation.
Real Examples of How Metadata Can Be Misinterpreted
Example: The Date Does Not Match the Alleged Incident
A photograph is said to have been taken on 10 March, but the file displayed on a computer shows a creation date of 14 March.
It may be tempting to conclude that the photograph could not have been taken on 10 March.
However, the displayed file-system date might relate to when the file was copied, downloaded or created on that particular storage system rather than when the photograph itself was captured.
A forensic examination may identify other embedded information relevant to the original capture time.
Example: Editing Software Appears in the Metadata
A photograph contains metadata referring to image-editing software.
This does not necessarily establish that the photograph has been deceptively manipulated.
The software might have been used to resize the image, convert its format, adjust its orientation or perform another routine operation. Further examination would be required to determine the significance of the observation.
Example: A Photograph Contains No EXIF Metadata
An image submitted in proceedings contains no camera information, date of capture or GPS data.
The absence of this information does not establish that the photograph is fake.
Messaging applications, social-media platforms, screenshots and other processing operations can remove metadata. Establishing how the file was obtained may therefore be particularly important.
Example: The Metadata Appears Completely Consistent
A photograph contains a plausible date, camera model and other expected metadata.
This is useful information, but it should not automatically be interpreted as proof that the image is authentic.
Metadata can potentially be altered or recreated. Where authenticity is genuinely disputed, the relationship between the metadata, file structure, media content and alleged provenance should be considered.
What About Screenshots?
Screenshots present particular difficulties.
A screenshot may accurately depict what appeared on a screen, but it can also remove much of the information contained within the original material.
For example, a screenshot of a photograph generally provides information about the creation of the screenshot, rather than preserving all of the metadata associated with the original photograph.
Similarly, screenshots of messages or social-media content may omit surrounding conversations, account information or other contextual data.
Where possible, the original files or source data should therefore be obtained rather than relying solely on screenshots.
Does Missing Metadata Mean a File Has Been Tampered With?
No.
Missing metadata may have many legitimate explanations.
Some devices record relatively little metadata in the first place, while messaging applications, websites and conversion processes may remove information.
The absence of metadata may limit the conclusions that can be reached, but absence alone is not proof of manipulation.
Is the Original File Important?
Where authenticity is disputed, obtaining the earliest available version of the file is generally preferable.
Repeatedly sharing, converting or exporting digital evidence can change its metadata and technical characteristics. In some circumstances, potentially useful forensic information may be permanently lost.
Legal teams should therefore consider obtaining the original or earliest available files before asking a witness or client to repeatedly email, upload or convert them.
Where appropriate, the device on which the material was originally recorded may also be relevant.
What Should Solicitors and Barristers Obtain?
Where the authenticity of a photograph or video may become an issue, it is useful to establish the provenance of the evidence as early as possible.
Where available, legal teams should seek:
the original or earliest available digital file;
information about the device used to make the recording;
details of how the file was transferred or supplied;
information concerning any editing, exporting or conversion;
earlier versions of the file, where relevant; and
the recording device itself where its examination is necessary and proportionate.
Importantly, the evidential file should ideally be preserved before unnecessary processing or conversion takes place.
Can Metadata Help Detect AI-Generated or Manipulated Images?
Potentially, but metadata alone cannot reliably determine whether an image is AI-generated or manipulated.
Some software may leave identifiable information within a file, and inconsistencies between the claimed provenance and the technical characteristics of a file may be relevant.
However, the absence of an AI or editing-software identifier does not establish that an image is genuine.
As generative AI and image-processing tools become increasingly accessible, questions of authenticity may require consideration of the file's provenance, metadata, structure and visual characteristics together.
When Should a Forensic Expert Be Instructed?
Expert examination may be appropriate where:
a party disputes that a photograph or video is genuine;
there is an allegation that evidence has been edited or manipulated;
dates or times associated with a file are important to the case;
metadata appears inconsistent with the account provided;
there are concerns about AI-generated or AI-manipulated material;
only copies, screenshots or exported versions are available; or
the provenance of important digital evidence is unclear.
Early instruction can also help identify what material should be obtained before potentially useful information is lost.
Frequently Asked Questions
Can metadata prove when a photograph was taken?
Metadata may contain a recorded date and time associated with image capture, but this information should be interpreted cautiously. Device clocks may be incorrect and metadata can potentially be altered or affected by subsequent processing.
Can you tell what phone took a photograph?
In some cases, metadata or other characteristics may identify the make or model of device associated with a photograph. Whether this information is available depends upon the file and its history.
Can you tell whether a photograph has been edited?
Sometimes there may be evidence consistent with editing or subsequent processing. The strength of any conclusion depends upon the available material and the nature of the alleged manipulation.
Does Photoshop metadata prove that an image was manipulated?
Not necessarily. Evidence that a file has interacted with editing software does not by itself establish what was done to the image or whether its evidential content was changed.
Can metadata be faked?
Some metadata fields can be deliberately altered or recreated. Metadata should therefore be interpreted alongside other technical findings and the known provenance of the evidence.
Does WhatsApp remove photo metadata?
Messaging and sharing processes can alter the file supplied to a recipient and may remove metadata that was present in an original photograph. Where the original file is available, it may therefore provide substantially more forensic information than the shared version.
Can metadata detect a deepfake?
Metadata may provide relevant evidence, but it cannot by itself reliably determine whether media is a deepfake. Examination may require consideration of provenance, file structure, encoding characteristics and the media itself.
Is a screenshot as good as the original photograph?
Generally, a screenshot contains different technical information from the underlying photograph and may discard information useful to forensic examination. Where authenticity is in issue, obtaining the original or earliest available file is preferable.
Forensic Examination of Photographs and Video Evidence
Where the authenticity, provenance or integrity of digital imagery is disputed, forensic examination can assist in determining what conclusions are supported by the available evidence.
Verden Forensics provides independent forensic examination of photographs, video and CCTV evidence for criminal, civil and family proceedings.
Where possible, obtaining expert advice before files are converted, repeatedly shared or otherwise processed can help preserve potentially important forensic information.
If you require expert examination of a photograph, video or other digital imagery, contact Verden Forensics to discuss the evidence available and the examinations that may be appropriate.