Part of a series on
Forensic science
Physiological Anthropology Biology Bloodstain pattern analysis Dentistry DNA phenotyping DNA profiling Forensic genealogy Entomology Epidemiology Limnology Medicine Palynology Pathology Podiatry Toxicology
Social Psychiatry Psychology Psychotherapy Social work Verbal autopsy
Criminalistics Accounting Body identification Chemistry Colorimetry Election forensics Facial reconstruction Fingerprint analysis Firearm examination Footwear evidence Forensic arts Profiling Gloveprint analysis Palmprint analysis Questioned document examination Vein matching Forensic geophysics Forensic geology Social network analysis
Digital forensics Computer exams Data analysis Database study Location analysis Malware analysis Mobile devices Network analysis Photography Video analysis Audio analysis
Related disciplines Electrical engineering Engineering Fire investigation Fire accelerant detection Fractography Linguistics Materials engineering Polymer engineering Statistics Traffic collision reconstruction
Related articles Crime scene CSI effect DNA in forensic entomology Perry Mason syndrome Pollen calendar Skid mark Trace evidence
Outline Category
v t e

Exif is supported by almost all digital camera manufacturers.

The metadata tags defined in the Exif standard cover a broad spectrum:

• Camera settings: This includes static information such as the camera model and make, and information that varies with each image such as orientation (rotation), aperture, shutter speed, focal length, metering mode, and ISO speed information
• Image metrics: Pixel dimensions, resolution, colorspace, and filesize
• Date and time information, digital cameras will record the current (local) date and time set on the device and save this in the metadata
• Location information
• A thumbnail for previewing the picture on the camera's LCD screen, in file managers, or in photo manipulation software
• Descriptions
• Copyright information

The Japan Electronic Industries Development Association (JEIDA) produced the initial definition of Exif. Version 2.1 of the specification is dated 12 June 1998.^{[citation needed]} JEITA established Exif version 2.2 (a.k.a. "Exif Print"), dated 20 February 2002 and released in April 2002.^[7] Version 2.21 (with Adobe RGB support) is dated 11 July 2003, but was released in September 2003 following the release of DCF 2.0. Version 2.3 was released on 26 April 2010, and revised to 2.31 in July 2013 and revised to 2.32 on 17 May 2019, was jointly formulated by JEITA and CIPA. The latest version, 3.0, was released in May 2023, and brings, among other things, support for UTF-8 to allow text data in non-ASCII encoding.^[4]

The Exif tag structure is borrowed from TIFF files. On several image specific properties, there is a large overlap between the tags defined in the TIFF, Exif, TIFF/EP, and DCF standards. For descriptive metadata, there is an overlap between Exif, IPTC Information Interchange Model and XMP info, which also can be embedded in a JPEG file. The Metadata Working Group has guidelines on mapping tags between these standards.^[8]

When Exif is employed for JPEG files, the Exif data are stored in one of JPEG's defined utility Application Segments, the APP1 (segment marker 0xFFE1), which in effect holds an entire TIFF file within. When Exif is employed in TIFF files (also when used as "an embedded TIFF file" mentioned earlier), the TIFF Private Tag 0x8769 defines a sub-Image File Directory (IFD) that holds the Exif specified TIFF Tags. In addition, Exif also defines a Global Positioning System sub-IFD using the TIFF Private Tag 0x8825, holding location information, and an "Interoperability IFD" specified within the Exif sub-IFD, using the Exif tag 0xA005.

Formats specified in Exif standard are defined as folder structures that are based on Exif-JPEG and recording formats for memory. When these formats are used as Exif/DCF files together with the DCF specification (for better interoperability among devices of different types), their scope shall cover devices, recording media, and application software that handle them.

The Exif format has standard tags for location information. As of 2014^[update], many cameras and mobile phones have a built-in GPS receiver that stores the location information in the Exif header when a picture is taken. Some other cameras have a separate GPS receiver that fits into the flash connector or hot shoe. Recorded GPS data can also be added to any digital photograph on a computer, either by correlating the time stamps of the photographs with a GPS record from a hand-held GPS receiver or manually by using a map or mapping software. Some cameras can be paired with cellphones to provide the geolocation. The process of adding geographic information to a photograph is known as geotagging. Photo-sharing communities like Panoramio, locr or Flickr equally allow their users to upload geocoded pictures or to add geolocation information online.

Exif data are embedded within the image file itself. While many recent image manipulation programs recognize and preserve Exif data when writing to a modified image, this is not the case for most older programs. Many image gallery programs also recognise Exif data and optionally display it alongside the images.

Software libraries, such as libexif^[9] for C and Adobe XMP Toolkit^[10] or Exiv2^[11] for C++, Metadata Extractor^[12] for Java, PIL/Pillow for Python, LEADTOOLS or ExifTool^[13] for Perl, parse Exif data from files and read/write Exif tag values.

The Exif format has a number of drawbacks, mostly relating to its use of legacy file structures.

• The derivation of Exif from the TIFF file structure using offset pointers in the files means that data can be spread anywhere within a file, which means that software is likely to corrupt any pointers or corresponding data that it does not decode/encode. For this reason most image editors damage or remove the Exif metadata to some extent upon saving.^[14]
• The standard defines a MakerNote tag, which allows camera manufacturers to place any custom format metadata in the file. This is used increasingly by camera manufacturers to store camera settings not listed in the Exif standard, such as shooting modes, post-processing settings, serial number, focusing modes, etc. As the tag contents are proprietary and manufacturer-specific, it can be difficult to retrieve this information from an image or to properly preserve it when rewriting an image. Manufacturers can encrypt portions of the information; for example, some Nikon cameras encrypt the detailed lens data in the MakerNote data.^[15]
• Exif is very often used in images created by scanners, but the standard makes no provisions for any scanner-specific information.^{[citation needed]}
• Photo manipulation software sometimes fails to update the embedded thumbnail after an editing operation, possibly causing the user to inadvertently publish compromising information.^[16] For example, someone might blank out a licence registration plate of a car (for privacy concerns), only to have the thumbnail not so updated, meaning the information is still visible.
• Exif metadata are restricted in size to 64 kB in JPEG images because according to the specification this information must be contained within a single JPEG APP1 segment. Although the FlashPix extensions allow information to span multiple JPEG APP2 segments, these extensions are not commonly used. This has prompted some camera manufacturers to develop non-standard techniques for storing the large preview images used by some digital cameras for LCD review. These non-standard extensions are commonly lost if a user re-saves the image using image editor software, possibly rendering the image incompatible with the original camera that created it. (In 2009, CIPA released the Multi Picture Object specification which addresses this deficiency and provides a standard way to store large previews in JPEG images.^[17])
• Prior to version 2.31 (July 2016) there was no way to record time zone information for an image, resulting in ambiguity. For example, a camera might record the "DateTimeOriginal" value using its local time zone, but a program reading the file later could mistakenly interpret that time as UTC.
• There is no standard field to record readouts of a camera's accelerometers or inertial navigation system. Such data could help to establish the relationship between the image sensor's XYZ coordinate system and the gravity vector (i.e., which way is down in this image). It could also establish relative camera positions or orientations in a sequence of photos. Some software records this information using the GPSImgDirection tag along with custom GPSPitch and GPSRoll tags.^[18]
• The XResolution and YResolution tags provide the number of pixels per length unit for the width and height of the image, respectively. (The length unit itself is specified by the tag ResolutionUnit.) By default, these tags in combination are set to 72 pixels per inch (ppi).^[19] These tags were inherited from the TIFF 6.0 standard and are required^[20] even though for images produced by digital cameras, image resolution values such as ppi are meaningless.^[21]

Since the Exif tag contains metadata about the photo, it can pose a privacy problem. For example, a photo taken with a GPS-enabled camera can reveal the exact location and time it was taken, and the unique ID number of the device - this is all done by default - often without the user's knowledge. Many users may be unaware that their photos are tagged by default in this manner, or that specialist software may be required to remove the Exif tag before publishing. For example, a whistleblower, journalist or political dissident relying on the protection of anonymity to allow them to report malfeasance by a corporate entity, criminal, or government may therefore find their safety compromised by this default data collection.

In December 2012, anti-virus businessman John McAfee was arrested in Guatemala while fleeing from alleged persecution^[22] in neighboring Belize. Vice magazine had published an exclusive interview on their website with McAfee "on the run"^[23] that included a photo of McAfee with a Vice reporter taken with a phone that had geotagged the image.^[24] The photo's metadata included GPS coordinates locating McAfee in Guatemala, and he was captured two days later.^[25] McAfee later claimed to have edited the Exif data from his phone to provide a false location.^[26]

According to documents leaked by Edward Snowden, the NSA is targeting Exif information under the XKeyscore program.^[27]

The privacy problem of Exif data can be avoided by removing the Exif data using a metadata removal tool.^[28]

Metadata Working Group was formed by a consortium of companies in 2006 (according to their web page) or 2007 (as stated in their own press release). Version 2.0 of the specification was released in November 2010,^[8] giving recommendations concerning the use of Exif, IPTC and XMP metadata in images.

Extensible Metadata Platform (XMP) is an ISO standard, originally created by Adobe Systems Inc., for the creation, processing and interchange of standardized and custom metadata for digital documents and data sets. IPTC was developed in the early 1990s by the International Press Telecommunications Council (IPTC) to expedite the international exchange of news among newspapers and news agencies.

Not all devices use every available metadata field in the Exif standard.

The following table shows Exif metadata for a photo made with a typical digital camera. Authorship and copyright information is generally not provided in the camera's output, so it must be filled in during later stages of processing. Some programs, such as Canon's Digital Photo Professional, allow the name of the owner to be added to the camera itself.

In addition to the basic date and time tags (DateTime, DateTimeOriginal, and DateTimeDigitized), there are three corresponding "subsecond" tags: SubsecTime, SubsecTimeOriginal, and SubsecTimeDigitized. The SubsecTime tag is defined in version 2.3 as "a tag used to record fractions of seconds for the DateTime tag;"^[6] the SubsecTimeOriginal and SubsecTimeDigitized fields are defined similarly. The subsecond tags are of variable length, meaning manufacturers may choose the number of ASCII-encoded decimal digits to place in these tags. For DateTime = 2000:01:01 00:00:00, the actual time with various subsecond values would be:

• SubsecTime = 2: 2000:01:01 00:00:00.2
• SubsecTime = 23: 2000:01:01 00:00:00.23
• SubsecTime = 234: 2000:01:01 00:00:00.234
• SubsecTime = 2345: 2000:01:01 00:00:00.2345

The standard does not specify which particular event during the "taking" of a picture the time tags should describe. The standard is, in fact, ambiguous. The DateTimeOriginal tag is defined as "The date and time when the original image data was generated." For an exposure—say, 30 seconds—longer than the granularity of the timestamp (one second for the DateTimeOriginal tag), the tag's time could correspond to the beginning of the exposure, the end of the exposure, or some other time. This confusion is exacerbated for the subsecond tags, where the granularity (down to 1/10000th of a second in the examples in the standard) is shorter than many common exposure durations.

As noted above, tags to specify the previously-missing timezone information were added in Exif version 2.31. These are "OffsetTime", "OffsetTimeOriginal" and "OffsetTimeDigitized". They are formatted as seven ASCII characters (including the null terminator) denoting the hours and minutes of the offset, like +01:00 or -01:00. The offset is "from UTC (the time difference from Universal Coordinated Time including daylight saving time) of the time of"^[6] the matching tag.

The Exif specification also includes a description of FPXR (FlashPix-ready) information, which may be stored in APP2 of JPEG images using a structure similar to that of a FlashPix file.^[30] These FlashPix extensions allow meta-information to be preserved when converting between FPXR JPEG images and FlashPix images. FPXR information may be found in images from some models of digital cameras by Kodak and Hewlett-Packard.^[31] Below is an example of the FPXR information found in a JPEG image from a Kodak EasyShare V570 digital camera:

The Exif specification describes the RIFF file format used for WAV audio files and defines a number of tags for storing meta-information such as artist, copyright, creation date, and more in these files.^[32] The following table gives an example of Exif information found in a WAV file written by the Pentax Optio WP digital camera:

The "MakerNote" tag contains image information normally in a proprietary binary format. Some of these manufacturer-specific formats have been decoded:

• OZHiker (not updated since 2008): Agfa, Canon, Casio, Epson, Fujifilm, Konica/Minolta, Kyocera/Contax, Nikon, Olympus, Panasonic, Pentax/Asahi, Ricoh, Sony^[33]
• Kamisaka (not updated since 2007): Canon, Casio, FujiFilm, ISL, KDDI, Konica/Minolta, Mamiya, Nikon, Panasonic, Pentax, Ricoh, Sigma, Sony, WWL^[34]
• X3F Info: Sigma/Foveon^[35]
• ExifTool: Canon, Casio, FujiFilm, GE, HP, JVC/Victor, Kodak, Leaf, Minolta/Konica-Minolta, Nikon, Olympus/Epson, Panasonic/Leica, Pentax/Asahi, Reconyx, Ricoh, Samsung, Sanyo, Sigma/Foveon, Sony, etc.^[36]
• Olypedia: Olympus^[37]

The proprietary formats used by many manufacturers break if the MakerNote tag data is moved (i.e. by inserting or editing a tag that precedes it). The reason to edit to the Exif data could be as simple as to add copyright information, an Exif comment, etc. There are two solutions for this problem:

• When the Exif data is saved, the MakerNote data is stored at the same place as before.
• A special offset tag is added. This tag contains the information by how many bytes the MakerNote data was moved in comparison to the original index.

Microsoft has implemented the last solution in Windows 10: In the Windows explorer you can change the Exif data of an image file by the properties window. Here the tab sheet "Details" contains some Exif data like title, subject, comments etc. and these Exif data can also be changed and stored. When the image file is saved the tag "OffsetSchema" (tag ID = 0xea1d) is added and this tag contains a signed 32 bit number. With this number the original index of "MakerNote" can be restored:

Original index of "MakerNote" = Current index of "MakerNote" - Value of tag "OffsetSchema"

But the tag "OffsetSchema" was defined by Microsoft and it is not part of the official Exif standard.

In some cases, camera vendors also store important information only in proprietary makernote fields, instead of using available Exif standard tags. An example for this is Nikon's ISO speed settings tag.^[38]

• APEX system
• Comparison of image viewers (Exif view/edit functions)
• Design rule for Camera File system (DCF)
• Digital photography
• eXtensible Metadata Platform (XMP)
• Geotagged photograph
• Image file format
• IPTC Information Interchange Model
• JPEG File Interchange Format
• Metadata Working Group
• Tag Image File Format / Electronic Photography (TIFF/EP)
• JEIDA memory card