"Forensic" check of a photo

pclab

pclab

Moderator
Hi

Need some help here.

Today I had a client with 2 photos that she brought to me into a flash drive.
She, at least, wants to know the date of when the pictures were taken.
I have checked with Winhex and can't see nothing, besides the day of when the picture was saved into the flash drive.
This calls for a more "forensic" procedure.
What do you guys recommend? Is there any change of getting that?

Thanks
 
Jared

Jared

Administrator
Staff member
In that case I'd guess that they aren't the original digital camera pictures. Were they emailed or anything like that before being put on the thumbdrive? Probably the file was converted losing the metadata.
 
Jared

Jared

Administrator
Staff member
Yeah, unfortunately most email programs try to shrink pictures to make the message smaller and in the process they lose all the metadata. If you could get the originals you'd be able to get a lot more information.
 
lcoughey

lcoughey

Moderator
Forensic investigation can only happen against the original media or a forensically sound copy. When you copy a file from one location to another, the meta data gets altered. It gets altered even more when the file is opened. This isn't TV land, this is real life. If they want a true forensic analysis, you will need the original file on the original source so that you can make a forensically sound image, get an MD5 HASH and then work from the image in a read-only manner.
 
pclab

pclab

Moderator
Hi Luke

Actually I told her that, without being to much of an expert ahhahahha
Well, it seems she wants to get her husband by something.
Unfortunately I will no be able to help....

Thanks Guys,
 
You must log in or register to reply here.
Top