Digital Images are everywhere these days claiming to show ghosts and spirits. They are submitted as evidence. But most can be explained if only we knew a bit about the picture itself. With Digital Images we can.
Before going on I should point out that while EXIF Data tells much about a digital image , it is not foolproof. But one of the first signs a picture has been altered is a lack of the EXIF data file. If you get a photo for analysis without this data, unless a good explanation can be found, I personally would not waste my time with it. I treat those as an attempt to fool or hoax an image. EXIF data is often destroyed when altering an image and the question arises, why was this picture altered? Plus, there are programs available which allow one to alter EXIF data in order to create a hoax. Consequently EXIF data is not a defining object, but certainly can aid in determining conditions when a picture was made. It is assumed for the purpose of this article that no hoax is intended.
Looking At The Data
Much emphasis is placed on the EXIF data when evaluating a digital image. But how many really know what is contained and what it means? This synopsis will explain a few of the more important data contained in this file. It is by no means a complete explanation, it only highlights the important aspects as related to evaluating a picture as submitted for consideration. Also be aware that different cameras may provide different data and the terminology may vary. The example shown here was taken from an image I made using a Canon SX100 PowerShot. Yours may differ.
The above image used as an example is a daytime shot. Refer to the following EXIF Data Table as each line is explained below. The Exif Data is divided into three main sections. The first, Main Information, is a general summary of the camera itself. The second, Sub Information, breaks this down into more detail. The third section, User comment, relates to how the camera was set up for this particular image. In many cases this data is determined by the user and the settings he applies to the camera. In some tables this is combined with the Sub Information section. Note that some fields are not mentioned . These are generally unimportant for most images, or they may be reserved for data not included in this particular make / model of camera.
Original EXIF Data for the above photo ( Note, the above image is reduced for this page and EXIF data is not directly available )
Make : Canon
Model : Canon PowerShot SX100
Orientation : left-hand side
XResolution : 180/1
YResolution : 180/1
ResolutionUnit : Inch
DateTime : 2013:08:15 11:09:12
YCbCrPositioning : centered
ExifInfoOffset : 196
ExposureTime : 1/500Sec
FNumber : F4.0
ISOSpeedRatings : 80
ExifVersion : 0220
DateTimeOriginal : 2013:08:15 11:09:12
DateTimeDigitized : 2013:08:15 11:09:12
ComponentConfiguration : YCbCr
CompressedBitsPerPixel : 3/1 (bit/pixel)
ShutterSpeedValue : 1/501Sec
ApertureValue : F4.0
MaxApertureValue : F2.8
MeteringMode : Division
Flash : Not fired(Compulsory)
FocalLength : 6.00(mm)
MakerNote : Canon Format : 2408Bytes (Offset:690)
ExifImageWidth : 3264
ExifImageHeight : 2448
FocalPlaneXResolution : 3264000/225
FocalPlaneYResolution : 2448000/169
FocalPlaneResolutionUnit : Meter
ExposureMode : Auto
DigitalZoomRatio : 3264/3264
SceneCaptureType : Standard
Vendor Original Information
MacroMode : Off
Self-timer : Off
Quality : Fine
FlashMode : Off
Easy shooting mode : Full auto
Digital Zoom : Off
FocusType : Auto
AF point selected : Unknown (8197)
ExposureProgram : Easy shooting
Focal length of lens : 6-60(mm)
Long Shutter Mode : Off
Explanation Of Fields:
Make and Model: - Just as it states, the Make and Model of the camera used, in this case a Canon Power Shot SX100
Orientation: The orientation of the camera relative to the scene, when the image was captured. Outlines the direction the image was rendered, in this case it was rendered left to right. Not important for doing image analysis
X Resolution and Y Resolution: The detail of the image in Dots Per Inch. This picture is 180 DPI. the higher the number the more detailed the image. X and Y represent Horizontal and vertical.
Resolution Unit: The scale the resolution detail was measured, in this case, Inch
Date Time: The Date and Time the image was made. This assumes the user has set the date correctly on his camera. (Some don't!)
YCbCrPositioning: Generally not too important to analyzing a basic picture unless saturation or intensity is an isue. But to explain, we need to define YCbCr. This is one of two primary color spaces used to represent digital component video (the other is RGB). The difference between YCbCr and RGB is that YCbCr represents color as brightness and two color difference signals, while RGB represents color as red, green and blue. In YCbCr, the Y is the brightness (luma), Cb is blue minus luma (B-Y) and Cr is red minus luma (R-Y). The term Centered as it applies here indicates that the camera used a default setting and no adjustment was made. (Normal Image)
EXIFInfoOffset: A value related to the table and related data handling. Not important for analyzing the image itself, only if a question arises related to the data processing and the table would this become an issue.
Next under the Heading of Sub Information we have the data related to the image itself. This is the area where most image anomalies can be identified. Conditions related to exposure are detailed here.
Exposure Time: This is the shutter speed in seconds when the image was made.
FNumber : The setting is the aperture setting of the lens (F-Stop) when the image was made.
ISOSpeedRatings : The sensitivity of the CCD imager when the image was made. It is equivalent to the Ag-Hr Filmrate.(ASA) Note: Shutter Speed, F-Stop, and ISO Speed are probably the most important details you need when starting analysis of any image.
ExifVersion : The version of EXIF included with this camera. Not important unless an issue arises related to the file itself.
DateTimeOriginal and DateTimeDigitized: Normally these two are the same unless a modification was made. It is the Date and Time the image was made and the time it was placed in a digital format. But sometimes if one attempts to alter the image the Digitized Time will show the time the alteratuon was made. May sometimes help you spot a hoax.
CompressedBitsPerPixel : The average compression ratio of the JPG image In this case 3/1 (bit/pixel)
ShutterSpeedValue : The actual shutter speed of the camera used. Generally the same as exposure time although some cameras may use a digital value which must be converted to actual seconds.
ApertureValue : The actual aperture used to make the image. Should be the same as the FNumber although some cameras may use a digital value which must be converted to the actual F-Stop.
MaxApertureValue : The maximum aperture setting the camera is capable of using, not necessarily the same as that used in the image.
MeteringMode :The method used by the camera to determine settings. (Center, Multispot, Spot, etc.)
Flash : Whether or not the flash fired. Compulsory means the camera was configured to flash or not flash regardless of light conditions.
FocalLength : Focal length of lens in millimeters. In this case it was 6.00(mm)
MakerNote : Internal data used by manufacturer. Not important for analyzing image.
Finally under the User Comment Section we find additional information related to the image. Some manufacturers include this data under the Sub Information heading.
ExifImageWidth and ExifImageHeight : This is the full size of the main image in pixels.
FocalPlaneXResolution and FocalPlaneYResolution :Pixel density of the CCD imager in the camera. Generally not important for analysis of image although a higher density results in a sharper image. Determined by the camera itself.
FocalPlaneResolutionUnit : Unit of measure which determined the FocalPlaneResolution.
ExposureMode : Program used to make image, in this case "Auto" means camera was used in automatic as opposed to aperture priority, shutter priority, etc. These settings were determined by the user at the time the picture was made.
DigitalZoomRatio : If digital zoom was used this would indicate the ratio of digital to optical zoom. This image ratio is 3264/3264. Since both numbers (pixels) are the same no digital zoom was used.
The Vendor Original Information provides additional data unique to individual manufacturers. Your camera may provide additional data not covered here, or its terminology may differ.
MacroMode : If the camera has the ability to do Macro images this will give its status. In this case it was Off
Self-timer : The Self Timer was not used for this image.
Quality :If the camera has multiple quality settings this field will show which was used for the picture. In this case "Fine" was selected.
FlashMode : The status of the flash. In this case it was forced off, likley because the image was made in daylight and the flash was not raised.
Easy shooting mode : Like many digital cameras, this camera has multiple modes, Daytime, Night, Cloudy, Sunny, etc. In this case instead this image was made in the Full Auto Mode which allowed the camera to pick the optimum settings.
Digital Zoom : Status of the Digital Zoom. In this case it was turned Off
FocusType :Type of Focus. This image was made using the Auto Focus feature of the camera.
ExposureProgram : (See Easy Shooting above.) Easy Shooting is the terminology for the "Point and Shoot" option with this camera.
Focal length of lens : The range of the Optical Zoom feature of this camera. 6-60(mm)
Long Shutter Mode : This indicates the "Bulb" setting was not used. "Bulb" is the old terminology for holding the shutter open the entire time the shutter button is depressed allowing for extremely long exposure times.
There are additional factors available but they are generally not needed to do an analysis of most images. Your camera may have additional data not included here. You can do a search for this on the manufacturer's website or other reference sites. Hopefully this will give the reader an idea why the EXIF data is so important and why I will not do any analysis unless it is available.