What EXIF is and what it can prove
The capture settings a camera writes into a photo. It tells you the body, lens, time and place, but anyone can edit it, so it is a self-declaration, not evidence.
Where EXIF comes from
EXIF (Exchangeable Image File Format) was specified in 1995 by the Japan Electronic Industries Development Association and is followed by practically every digital camera and phone. It borrows TIFF's directory structure and packs dozens to hundreds of tags into a JPEG APP1 segment that begins with Exif\0\0. PNG later added an eXIf chunk, WebP has an EXIF chunk, HEIC keeps it in the meta box.
Common fields
| Field | Meaning |
|---|---|
| Make / Model | camera brand and model |
| LensModel | lens |
| DateTimeOriginal | when the shutter fired (local time, no zone) |
| ExposureTime / FNumber / ISOSpeedRatings | shutter, aperture, sensitivity |
| FocalLength | focal length |
| GPSLatitude / GPSLongitude | location |
| Software | the last program that wrote the EXIF |
| Orientation | rotation |
| MakerNote | vendor-private data, may include shutter count, focus points |
What it can tell you
A picture with full EXIF is usually internally consistent: a Canon body with a Canon lens, a focal length within the lens's range, DateTimeOriginal equal to DateTimeDigitized, a MakerNote in that vendor's layout. That consistency is what "looks like it came straight from a camera" rests on.
What it cannot tell you
EXIF is plain text. One exiftool command sets any field to any value:
exiftool -Make=Canon -Model="Canon EOS R5" -DateTimeOriginal="2024:05:01 10:00:00" fake.jpg
So EXIF is only "what the file says about itself", never "what happened". For a picture with camera fields but no C2PA, AuditImage's verdict reads "Camera or phone capture, per EXIF" and notes that it cannot be verified.
Clues to forgery
- Make and Model present but no exposure settings and no MakerNote: possibly typed in by hand.
Softwaresays Photoshop but there is no XMP edit history.DateTimeOriginaland XMPCreateDatediffer by more than a time zone.- An EXIF thumbnail whose content differs from the main image: the image was replaced.
- Resolution that does not match that camera model's sensor.
AuditImage checks the time and software mismatches automatically; the rest need a human comparison.
Privacy note
The GPS fields in EXIF reveal where a photo was taken. AuditImage flags GPS when present. Before sharing, remove it with exiftool -gps:all= photo.jpg or your phone gallery's "remove location" option.