What Picture Metadata Can and Cannot Tell You

What metadata actually records

Metadata is information stored alongside a digital file or embedded within it. For photographs, this information may include the camera manufacturer, device model, exposure settings, image dimensions, software used to process the file and the time associated with capture. Some photographs also contain GPS coordinates. The available fields depend on the device, file format, camera settings and subsequent handling.

EXIF, short for Exchangeable Image File Format, is a common metadata standard used by digital cameras and phones. Other information may be stored in IPTC or XMP fields. These can contain descriptions, copyright details, creator information and editing-related data. Not every image contains every category, and the absence of a field is not automatically suspicious.

How to inspect an image file

Start with the actual image file, not a preview displayed inside a social media app. Download the original attachment where possible and preserve an untouched copy. On Windows, file properties may expose basic details through the Details tab. On macOS, Preview and the operating system's file information tools can show some image properties. A dedicated metadata reader can expose additional EXIF fields.

Online metadata viewers are another option, but uploading a photograph may disclose private material to an external service. This matters especially when an image contains a child's face, a home interior, location information or other identifying details. Prefer an offline viewer when privacy is important. Before using any service, check what information it receives and whether the file is retained.

Inspect at least four areas: capture date, device information, software fields and location data. Record which fields are present and which are missing. Do not interpret a blank field as proof of manipulation. If a file reports an editing application, investigate what that application might have been used for. Routine cropping, resizing and color correction can all change metadata.

• Capture date and time, including any timezone information.
• Camera or phone manufacturer and model.
• Software and processing information.
• GPS coordinates, if present.
• Image dimensions and file format.

Capture dates, file dates and the timezone problem

One of the most common metadata mistakes is treating every date as the moment a photograph was taken. A file may have a capture timestamp, a modification timestamp and a filesystem creation timestamp. These can describe different events. Downloading a photograph on Tuesday can create a new local file on Tuesday even when the photograph was captured several years earlier.

Timezones create another complication. A device may record a local capture time, while a service displays a converted timestamp or stores a standardized time. If a photograph appears to have been taken at 9:00 p.m. but a website displays 8:00 p.m., that one-hour difference may reflect timezone handling. Check the field name, the device's settings and the publication context before treating the difference as evidence of an altered image.

Why screenshots require a different approach

A screenshot is an image of what appeared on a screen. It is not a preserved copy of the original social media post, message or webpage. A screenshot can show a username, profile photograph, timestamp and text while leaving out the information needed to establish where the content came from. Its metadata may describe the phone or computer that captured the screen, not the account that supposedly published the material.

This is why a fake screenshot checker should not rely on EXIF information alone. A screenshot of a fabricated post can have perfectly ordinary device metadata. An authentic screenshot can have no camera metadata at all. Both outcomes are expected for many screen captures. The useful questions concern the underlying content: does the post exist, does the account belong to the claimed person, and does the displayed text match the original publication?

To verify a tweet screenshot, first search for the account and distinctive phrases from the displayed text. Look for the post on the original platform or in a trustworthy archived record. Compare the account handle, publication time, reply context and visible engagement information where available. A screenshot can be edited to change any of these details. A matching profile picture or familiar interface is not sufficient authentication.

• Search an exact phrase from the alleged post.
• Check the account handle, not just its display name.
• Look for replies or surrounding posts that establish context.
• Compare the displayed timestamp with the original platform record.
• Treat an unavailable or deleted post as an unresolved source question.

Metadata changes during ordinary image handling

Metadata can disappear for routine reasons. Messaging platforms and social networks may resize photographs, recompress them or strip identifying fields when preparing files for distribution. Editing applications can write new software information or replace existing timestamps. A person can also deliberately modify metadata using widely available file utilities. These changes mean that metadata is useful evidence only when its origin and handling are understood.

Consider an example: a photograph contains a camera model, a capture time and GPS coordinates when first saved. After being sent through a messaging service, the downloaded copy contains the same visible scene but no camera details or location information. The missing fields do not prove that the photograph was fabricated. They may simply reflect the platform's processing.

Combining metadata with stronger evidence

Metadata becomes more useful when it agrees with independent information. A capture date can be compared with a known event timeline. GPS coordinates can be checked against visible landmarks. A camera model can be compared with a photographer's description, and an editing field can prompt questions about how the file was processed. Each comparison should be treated as a separate piece of evidence.

For important images, preserve the original file and note how it was obtained. Keep a working copy for inspection so that subsequent changes do not overwrite the source. Record the filename, file size, format and any relevant metadata fields. Then compare the image with an earlier publication or an independent account of the event. The next time an unfamiliar screenshot appears in a group chat, begin by asking for the original post or source before relying on its file properties.

Questions readers ask