What photo metadata (EXIF) can and can't prove

Almost every phone and camera writes metadata into each photo: the device, the time, the settings and often the location. It is the first thing many people check, and it is genuinely useful. It is also the easiest evidence to change, copy or lose.

What's usually in there

• Device: make and model, sometimes the lens.
• Time: when the photo was taken, sometimes with a time zone.
• Capture settings: exposure time, aperture, ISO, focal length.
• Location: GPS coordinates, if location was on.
• Software: the app or editor that last saved the file.

What metadata can support

• A make and model plus real capture settings are consistent with a photo taken on that device.
• A capture time that fits someone's account supports the timeline.
• A software tag such as an editing app shows the file was saved by that app, which means it was processed after capture.

What metadata can't prove

• That the photo is genuine. Metadata is ordinary text inside the file. Free tools can write any camera, date or location into it.
• That a photo is fake because metadata is missing. Messaging apps, social platforms, screenshots and many upload forms remove it. Missing metadata usually means the photo was shared, nothing more.
• That a photo was edited because it was processed. Re-saving or resizing changes some fields; it says nothing about whether the picture's content changed.

Stronger evidence than metadata

Signed Content Credentials (C2PA) are tied to the file by cryptography, so changing them breaks the signature. An exact hash match against a file collected earlier proves the file hasn't changed since then. When those exist, they outweigh metadata. When they don't, metadata is still useful support, just not proof.

Device-specific details

Phone makers write their own extra fields. Apple and Samsung, for example, add device-specific records that a careful check can compare against the standard fields. When these agree, they support the file having come from that kind of phone. They are still embedded in the file and unsigned, so they support origin without proving an untouched original.

How PIT uses metadata

PIT treats metadata as supporting evidence. A camera make or model alone isn't enough; PIT looks for real capture settings before it reports a camera capture as consistent, and it never reports a camera original from metadata alone. When metadata is missing, PIT says what that does and doesn't mean, and the answer is often "unknown".

FAQ

How do I see a photo's metadata?

On a computer, the file's properties or info panel shows some of it. PIT shows the full set in its technical details along with what each field supports.

Should I remove metadata before sharing photos?

For privacy, often yes, especially location. But keep an unaltered original if the photo might ever be evidence.