User avatar
pclab
Forum Moderator
Posts: 1624
Joined: Tue Jan 13, 2015 4:55 pm
Contact: Website Facebook

"Forensic" check of a photo

Thu Feb 26, 2015 12:53 pm

Hi

Need some help here.

Today I had a client with 2 photos that she brought to me into a flash drive.
She, at least, wants to know the date of when the pictures were taken.
I have checked with Winhex and can't see nothing, besides the day of when the picture was saved into the flash drive.
This calls for a more "forensic" procedure.
What do you guys recommend? Is there any change of getting that?

Thanks
www.pclab.com.pt
facebook.com/PCLAB.Assistencia.Tecnica

User avatar
Jared
Forum Admin
Posts: 3546
Joined: Mon Jan 12, 2015 12:32 pm
Location: Providence, RI
Contact: Website Facebook Twitter Skype YouTube Google+

Re: "Forensic" check of a photo

Thu Feb 26, 2015 1:03 pm

Have you tried Attribute Magic Pro?

I know that can read metadata of just about any common file type.

User avatar
pclab
Forum Moderator
Posts: 1624
Joined: Tue Jan 13, 2015 4:55 pm
Contact: Website Facebook

Re: "Forensic" check of a photo

Thu Feb 26, 2015 1:08 pm

Hi

No, I just have tried Winhex.
I will try that.
Thanks
www.pclab.com.pt
facebook.com/PCLAB.Assistencia.Tecnica

User avatar
pclab
Forum Moderator
Posts: 1624
Joined: Tue Jan 13, 2015 4:55 pm
Contact: Website Facebook

Re: "Forensic" check of a photo

Thu Feb 26, 2015 1:13 pm

Nothing. Doesn't work.
I get the date of the save time...
www.pclab.com.pt
facebook.com/PCLAB.Assistencia.Tecnica

User avatar
Jared
Forum Admin
Posts: 3546
Joined: Mon Jan 12, 2015 12:32 pm
Location: Providence, RI
Contact: Website Facebook Twitter Skype YouTube Google+

Re: "Forensic" check of a photo

Thu Feb 26, 2015 1:25 pm

In that case I'd guess that they aren't the original digital camera pictures. Were they emailed or anything like that before being put on the thumbdrive? Probably the file was converted losing the metadata.

User avatar
pclab
Forum Moderator
Posts: 1624
Joined: Tue Jan 13, 2015 4:55 pm
Contact: Website Facebook

Re: "Forensic" check of a photo

Thu Feb 26, 2015 1:42 pm

No, they aren't the original. She got them from an email.
www.pclab.com.pt
facebook.com/PCLAB.Assistencia.Tecnica

User avatar
Jared
Forum Admin
Posts: 3546
Joined: Mon Jan 12, 2015 12:32 pm
Location: Providence, RI
Contact: Website Facebook Twitter Skype YouTube Google+

Re: "Forensic" check of a photo

Thu Feb 26, 2015 2:18 pm

Yeah, unfortunately most email programs try to shrink pictures to make the message smaller and in the process they lose all the metadata. If you could get the originals you'd be able to get a lot more information.

User avatar
lcoughey
Forum Moderator
Posts: 595
Joined: Mon Jan 12, 2015 12:46 pm
Location: Ontario, Canada
Contact: Website Facebook Twitter Google+

Re: "Forensic" check of a photo

Thu Feb 26, 2015 2:33 pm

Forensic investigation can only happen against the original media or a forensically sound copy. When you copy a file from one location to another, the meta data gets altered. It gets altered even more when the file is opened. This isn't TV land, this is real life. If they want a true forensic analysis, you will need the original file on the original source so that you can make a forensically sound image, get an MD5 HASH and then work from the image in a read-only manner.

User avatar
pclab
Forum Moderator
Posts: 1624
Joined: Tue Jan 13, 2015 4:55 pm
Contact: Website Facebook

Re: "Forensic" check of a photo

Thu Feb 26, 2015 6:34 pm

Hi Luke

Actually I told her that, without being to much of an expert ahhahahha
Well, it seems she wants to get her husband by something.
Unfortunately I will no be able to help....

Thanks Guys,
www.pclab.com.pt
facebook.com/PCLAB.Assistencia.Tecnica

vaibhavs
Data Recovery Noob
Posts: 3
Joined: Wed Oct 28, 2015 6:30 am
Location: India

Re: "Forensic" check of a photo

Thu Oct 29, 2015 7:12 am

Hi,

Try JPEGSNOOP ... take a try.. it works in many cases.. but still you need a original copy..

Return to “Phones, Tablets, and Other Device Data Recovery”

Who is online

Users browsing this forum: No registered users and 0 guests