±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 3 Overall: 35628
New Yesterday: 2 Visitors: 162

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

EXIF timestampe vs Created timestamp question

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

yazenaswad
Member
 

EXIF timestampe vs Created timestamp question

Post Posted: Feb 25, 19 23:00

Hello All:

I was reviewing a photo and came across the timestamp records that I can not understand, I'd appreciate it if someone can explain it to me.

Photo was taken with the cellphone

Created time: 6/12/2016 9:00:46 pm
Last Modified: 6/12/2016 9:00:48 pm
Last accessed: 6/12/2016 11:18:46 pm
EXIF MAKE: Apple
EXIF Model: IPhone 6s pLUS
EXIF Digitalized timestamp: 4/9/2016 12:46:01 pm
EXIF Original timestamp: 4/9/2016 12:46:01 pm

The creation timestamp and EXIF original timestamp do not match. Almost all photos are the same case but not all.

Thank you  
 
  

JimC
Senior Member
 

Re: EXIF timestampe vs Created timestamp question

Post Posted: Feb 25, 19 23:16

Maybe the file has been copied or downloaded from iCloud?

In this case the file system timestamps may not match the EXIF fields.

Was the photo taken on that specific phone or another device?

Jim

www.binarymarkup.com  
 
  

randomaccess
Senior Member
 

Re: EXIF timestampe vs Created timestamp question

Post Posted: Feb 26, 19 06:50

Have you got the path of the file?

Generally I go with the "EXIF Digitalized timestamp" as the date that the photo was taken (which which device is a different story)  
 
  

yazenaswad
Member
 

Re: EXIF timestampe vs Created timestamp question

Post Posted: Feb 26, 19 21:51

- JimC
Maybe the file has been copied or downloaded from iCloud?

In this case the file system timestamps may not match the EXIF fields.

Was the photo taken on that specific phone or another device?

Jim

www.binarymarkup.com


The photo was taken on that specific IPhone.  
 
  

yazenaswad
Member
 

Re: EXIF timestampe vs Created timestamp question

Post Posted: Feb 26, 19 21:52

- randomaccess
Have you got the path of the file?

Generally I go with the "EXIF Digitalized timestamp" as the date that the photo was taken (which which device is a different story)


I will share the file path when I return to work by tomorrow.

Thank you  
 

Page 1 of 1