What EXIF is and what it holds
EXIF is a block of data a camera writes into an image file: make, model, lens, exposure, focal length, orientation, timestamp, and sometimes location. Editing software adds its own entries, so a file can also record which application last saved it.
None of it is signed. Every field is plain text that any tool can write, rewrite or remove. That is the first problem: EXIF was designed to be helpful to photographers, not to resist anybody.
The stripping problem
Almost every platform removes metadata when you upload. The reasons are sound: EXIF frequently contains GPS coordinates, and publishing somebody's home location because they posted a photo of their garden is a privacy failure. Stripping it also reduces file size.
The side effect is that provenance disappears at the first hop. An image that went from a camera, through an editor, onto a platform and into a message has been stripped at least once, usually twice.
A screenshot is a re-render, so it also discards the file structure entirely and starts a new one with no history.
The three failure modes
- Absent. The common case. No EXIF at all, which tells you the file has been through a platform and nothing about how it was made.
- Present but meaningless. A camera make and model written by an editing tool, or a timestamp reflecting the last save rather than the capture.
- Present and false. Any field can be written by hand. Setting a camera model on a generated image takes seconds and defeats every check that trusts EXIF.
The third one is why metadata-based verdicts are actively unsafe rather than merely weak. A tool that reports an image as genuine because it carries camera EXIF can be defeated by anybody who knows the field exists.
When EXIF is still worth reading
None of this makes metadata useless. It makes it useful in a narrow set of situations, and knowing which ones saves time.
| Situation | Useful? | Why |
|---|---|---|
| A file supplied directly by a photographer | Yes | Nothing has stripped it, and it cross-checks the account |
| An original from a claimant or a source | Yes | Device and timestamp can be checked against the story |
| A picture downloaded from social media | No | Stripped on upload |
| A screenshot | No | A new file with no history |
| An image forwarded through a chat app | Rarely | Most apps strip and recompress |
| A file where EXIF claims a camera | With care | The field is unsigned and trivially written |
The pattern is that EXIF works when you are close to the source and fails as soon as an image starts travelling. It is a chain of custody tool rather than a detection tool.
What replaced it
Two things, doing different jobs. Content Credentials are the signed successor to unsigned metadata: same idea, with cryptography attached so the record cannot be rewritten without detection. Where they survive, they are stronger than EXIF ever was.
Pixel analysis is the other half, and it exists because credentials also get stripped. Reading the image data itself is the only method that still works after an image has been through a platform, which is where the difficult questions actually arise.
How to preserve metadata when you want it
- Send files as documents, not as photos. Most messaging apps have a file option that transfers the original bytes.
- Ask for the original, from the device that took it, rather than a copy that has been through anything.
- Avoid screenshots entirely when the provenance matters. A screenshot discards the file and creates a new one.
- Archive the raw capture, not just the export, if you are the photographer.
- Check your export settings. Some tools strip metadata by default on save for web.
The reverse mistake
There is an error that runs the other way and it is becoming more common. Somebody finds camera metadata on an image and treats it as proof the picture is genuine.
Writing EXIF is trivial. Free tools will set a camera make, model, lens and timestamp on any file in seconds, including on an image that came straight out of a generator. A checker that reports genuine because it found a camera name is reporting what somebody typed.
The asymmetry is worth stating plainly. Absent metadata means nothing. Present metadata is weak evidence at best, and it is weakest exactly where somebody has a motive to fabricate it. Neither direction supports a confident conclusion on its own.
Content Credentials exist precisely to close this gap. The difference between the two is a signature, and that single difference is what separates a field anybody can write from a record that cannot be altered without detection.