Notifications
Clear all

EXIF question

5 Posts
5 Users
0 Likes
682 Views
(@guarana)
Posts: 6
Active Member
Topic starter
 

Can EXIF data be restored after deletion (just like ordinary data) and what tool do you think is the best to delete EXIF data?

 
Posted : 09/05/2017 5:31 am
Passmark
(@passmark)
Posts: 376
Reputable Member
 

There are lots of ways to remove the EXIF data.

For example,
In Photoshop, simply go to File -> Save for Web & Devices and make sure that "Metadata" is set to "None".

Once it is gone it can't be recovered (unless the original file is found elsewhere on the hard disk).

 
Posted : 09/05/2017 7:54 am
yungas
(@yungas)
Posts: 10
Active Member
 

Good afternoon friends,.
I would need to make a forence image of a hp thin client t510 16gb, as it is known it contains flash memory and not a hard disk.
What would be the correct way to extract the information?

 
Posted : 20/07/2017 3:15 am
jhup
 jhup
(@jhup)
Posts: 1442
Noble Member
 

Yes and no.

It depends on the OS, file system, and the actual file structure where the EXIF is "deleted".

For example, if the file system is a database file system type, some of those chucks of data which were modified are marked free, but not deleted. If the file system is a linear or streaming type (like tape or flash) the material can be in "historical" or previous segments of the storage. Those are potentially recoverable.

An other example is where the editing tool rewrites a jpeg APP1 block improperly. Since there can be multiple APP1, some tools will prepend the new APP1, but not remove the old one.

 
Posted : 20/07/2017 6:12 pm
(@bntrotter)
Posts: 63
Trusted Member
 

Agreed. I have been able to view EXIF data of deleted image files as long as there still fully intact. If one block of the file is overwritten, there is no telling how the Metadata will be displayed.

I used Netclean Analyze, IrfanView and Photoshop to view for metadata.

 
Posted : 20/07/2017 8:25 pm
Share: