Metadata in Digital Media

Metadata is data that provides information on other data. Within digital media, like photos or videos, it contains things like the creation date, location it was recorded, the applications used for editing, or even information about the creator of the item. This data is stored within the file itself, for instance via the use of Exif data, but it's not uncommon to find metadata in the source code of a webpage.

To make things more confusing, there are even several types of metadata. While Exif is well known, there's a chance that an image contains IPTC attributes, or XMP metadata, two other standards widely used nowadays.

But no matter what format it is, with the help of some simple tools, it's possible to find and extract this metadata. The information it contains might provide extra information that can be used for verification, geolocation, and even chronolocation. Via examples a few different sorts of metadata will be shown in this post.

Time to have a look at a few different ways of retrieving metadata and what it contains.


Example: YouTube

YouTube has an API that, among other things, can provide metadata on every video that is online. By querying the endpoint videos and requesting the snippet information, it's possible to retrieve the exact moment the video was uploaded. Since YouTube strips information on when the video itself was created, the capture date set by the recording device, this information is impossible to retrieve. But by using this API it is possible to retrieve information about the title, description, thumbnail URL's, tags and category, and it retrieves the exact date and time it was published in UTC+0 time. A time zone in UTC is recognizable by the Z at the end, also known as Zulu time.

An example of how this metadata looks for a YouTube video, can be seen below. This has been retrieved via the API for the video https://www.youtube.com/watch?v=hdDBKxJSAHQ

"id": "hdDBKxJSAHQ",
"snippet": {
"publishedAt": "2017-03-31T10:00:04.000Z",
"channelId": "UCa6vGFO9ty8v5KZJXQxdhaw",
"title": "April Fools' Day Pranks with Mark Rober",

Another way to retrieve the information is to use an online tool. Amnesty International created one in 2017, but one of the most complete tools out there is the YouTube Metadata tool created by Matthew Wright. It uses the same API in the background as mentioned above, and it also gives you the opportunity to convert the time to your local time with a single click, and even provides a link to start a reverse image search on the thumbnails.

Extracting information from a YouTube video
Extracting information from a YouTube video

Example: Instagram

Instagram strips all the information that is inside a photograph when it's uploaded, making it impossible to retrieve the creation date and time of a post. It is possible however to find out exactly when a photo was uploaded and published, by simply adding something to the URL. After opening the photo in the web browser, simply add ?__a=1 to the URL (that is two underscores after the question mark), and all metadata of the photo will be shown. After the page finished loading, simply search for 'created_at', and copy the numeric value that is mentioned after it.

Example of the metadata shown of URL: https://www.instagram.com/p/BvZCk-ig9kM/?__a=1
Example of the metadata shown of URL: https://www.instagram.com/p/BvZCk-ig9kM/?__a=1

As one can see, the creation date isn't in a usual time format for the average human being. This way of writing down times is very common on the internet though, and is called 'Unix time' or 'Epoch time'. It shows the amount of seconds that have passed since 00:00:00 UTC on January 1, 1970. These 'timestamps' can easily be converted to a human-readable form, by the use of online tools like EpochConverter. By converting the timestamp '1553519455', that was shown above in the example, we retrieve the following date and time: Sunday, 24 March 2019 13:35:18 GMT+01:00.

To find the date an Instagram post was created, search within the metadata for the value taken_at_timestamp. If you are curious about comments, then you can search for the values: created_at:

Example of the metadata shown of URL: https://www.instagram.com/p/BvZCk-ig9kM/?__a=1
Example of the metadata shown of URL: https://www.instagram.com/p/BvZCk-ig9kM/?__a=1

When the string of numbers is slightly longer, 13 numbers instead of 10, you probably found a timestamp in Unix time that contains milliseconds. Some platforms, applications, or systems have the need for a more accurate time, therefore using such format.

Example: Flickr

Flickr provides multiple pieces of information that can be retrieved. But first it is important to know that Flickr give users the ability to hide or show the metadata on any photograph that they upload. When full Exif information is available, this could provide information on anything from a location, to the camera and its settings that was used. To view it, look on the page for the camera information next to the map, and click 'Show EXIF'.

When it comes to dates and times inside metadata, it's important to know that there are several timestamps that can occur. And even though there are standards describing every tag or attribute, make sure that your interpretation of the data is correct. Let's have a look at a snippet of the IPTC information that could appear on your screen:

1) Date and Time (Modified)
2) Date and Time (Original)
3) Date and Time (Digitized)
4) Date Created
5) Time Created
6) Digital Creation Date
7) Digital Creation Time
8) Metadata Date

Spoiler alert, these can not all be found in the original file that was uploaded to Flickr. Some dates and times were added afterwards, and are there to provide extra information about the image as it appears online.


Online Tools

Even though there are different types and standards of metadata when it comes to digital media, the XMP specification has been adopted by many others. On the website of the IPTC Photo Metadata Standard example files can be downloaded that contain all the information that can be stored within an image file. To see what information is actually inside it, there are several options. Of course there's the option to upload it to a website, for instance by using Jeffrey's Image Metadata Viewer. This is one of the best online metadata viewers out there, but it comes with a catch.

Most people that run investigations usually don't upload any image to a third party, no matter how trustworthy the platform is. The reason for that is twofold. First, it's not always known what tools or techniques are used to read the information, process it and present it to your browser. Second, the image might be cached and stored on the web server for an unknown period of time, and might somehow end up somewhere that is undesirable.

When working with images that are public already, on social media for instance, this isn't a big issue. But this changes when dealing with highly sensitive material. My personal recommendation would be, to always save the media in an environment that is suitable for processing the information, and where it can be safely stored.

Built-in Tools

The easiest option for a lot of people, is to use tools that are already available with the operating system. Within Windows or Linux it's possible to view metadata by right-clicking the file and viewing the properties of a file. When using macOS, you can preview an image and open the 'Inspector' within the 'Tools' menu. All three operating systems show the information in their own format, but will all show pretty much the same information that comes embedded with the file.

Reading Exif information on a Mac
Reading Exif information on a Mac

Extensions and Add-ons

Another possibility is to use an extension or add-on in your browser, when researching mostly online media. There are multiple tools available, and even the IPTC has released their own official tools, but most come with drawbacks and issues. The IPTC extension merely send the URL to their website, where a lot of images can't be processed, due to hotlink protection. But when testing other extensions, some of them returned no information whatsoever, or only the mere basics like the creation date and resolution.

Since most investigations demand that the content is stored locally anyway, I would suggest dropping extensions, and if the default viewers of your operating system isn't good enough, there's one tool to view all metadata information: ExifTool.

ExifTool

This little free tool is one of the best ways to view metadata, and for a lot of people I know this is even the preferred choice. The program ExifTool is created by Phil Harvey, and is available for all major operating systems. And it doesn't only support images or photos, but also reads metadata from audio and video files, documents, compressed archives, font files and a lot more.

It has many options, but we're mainly interested in retrieving the metadata of a file. For that, simply open a command prompt and run: exiftool image.jpg, or whatever filename you pick. The tool will immediately spit out any information it is able to retrieve from the file, and displays it neatly underneath:

~$ exiftool 20210826_072335.jpg 
ExifTool Version Number         : 12.36
File Name                       : 20210826_072335.jpg
Directory                       : .
File Size                       : 2.4 MiB
File Modification Date/Time     : 2021:08:26 15:02:30+02:00
File Access Date/Time           : 2021:11:25 21:25:03+01:00
File Inode Change Date/Time     : 2021:11:25 21:25:02+01:00
File Permissions                : -rw-r--r--
File Type                       : JPEG
File Type Extension             : jpg
MIME Type                       : image/jpeg
Exif Byte Order                 : Little-endian (Intel, II)
Make                            : samsung
Camera Model Name               : SM-G991B
Orientation                     : Horizontal (normal)
X Resolution                    : 72
Y Resolution                    : 72
Resolution Unit                 : inches
Software                        : G991BXXU3AUGM
Modify Date                     : 2021:08:26 07:23:35

Conclusion

This is a small introduction into metadata and Exif, to accompany the long article about chronolocation. But as usual, there is always more to explain, but this article was meant to give some basic introduction about metadata as a whole, the different timestamps, and some easy to use tools that will be helpful during research.

Previous Post Next Post