Friday, December 19, 2014

Restoring stripped EXIF data

There's an interesting discussion happening over on Forensic Focus. It deals with the recoverability of stripped EXIF data. I get this type of question often, can stripped EXIF data be recovered? Here's a good explanation to add to your arsenal:

"If data are stripped, they are stripped, and gone to the heaven of bytes, wherever it is, forever, may they R.I.P.

Seriously, you can consider the JPEG format as a sort of "zip archive" with inside it a number of files, of which some are mandatory and some are optional:

  • the actual image compressed data is mandatory
  • the thumbnail preview is optional (and can be stripped)
  • the EXIF data is optional and contains in itself any number of (still optional) metadata fields (can be stripped selectively or "as a whole")

Typically an EXIF stripper does remove the actual bytes containing the data (if you prefer after having gone through an EXIF stripper usually the filesize becomes smaller, so there is no way that they can be recovered).

BUT there are tens or maybe hundreds of tools that are said to "strip metadata" and the "some sort of EXIF stripper" is way too vague to allow for an actual answer, it is entirely possible that the one or the other tool "leaves behind" some data, and as well it is possible to add to an image "custom" metadata and one (or the other) tool may simply miss them."

No comments: