General orientation, not legal advice. If a photo may matter in a legal dispute — an insurance claim, a landlord dispute, an accident, a workplace issue — how you handle it in the first hour matters more than anything you do later.
What Metadata Records
A camera or phone photo typically carries:
- Timestamp — when the photo was taken, per the device clock.
- Device — make and model, sometimes a serial number.
- Camera settings — exposure, ISO, focal length, flash.
- GPS coordinates and altitude, if location services were enabled.
- Software — any editing application that touched the file.
- Orientation and various technical fields.
Some devices also record Content Credentials, a signed record of origin and edits.
What It Can and Cannot Establish
Supports: that a file was created by a particular device at a stated time and place, consistent with other evidence; that a file has or hasn't been re-saved by editing software; that two photos came from the same device.
Cannot establish on its own:
- That the timestamp is true. It reflects the device clock, which can be wrong or deliberately changed.
- That the location is true. GPS can be spoofed, and coordinates can be edited.
- That the content is unaltered. Metadata is separate from pixels; an edited image can carry original metadata, and an unedited image can carry fabricated metadata.
- Who took it.
Metadata is corroborating evidence. It's most persuasive when it's consistent with independent facts — weather records, other people's photos, transaction logs, witness accounts.
How People Destroy It
This is the practical heart of the matter. Metadata is stripped or altered by:
- Sending via most chat apps as a "photo" — recompressed, resized, metadata removed.
- Uploading to most social platforms.
- Screenshotting the photo — creates a new file with new metadata and none of the original.
- Opening and re-saving in an editor.
- AirDrop/transfer settings that convert formats.
The photo you took is evidence. The copy your friend forwarded to you is much weaker.
Preserving a Photo as Evidence
- Do not edit the original. Ever. Work only on copies.
- Copy the file, not a screenshot, off the device — via cable, or a cloud service that preserves originals, or "send as file/document" rather than as a photo.
- Keep the original device untouched if possible; the file on the capturing device is the strongest version.
- Record a hash (a checksum) of the original file as soon as you can, and note the date you did so. This lets you demonstrate later that the file hasn't changed.
- Document the chain: who had the file, when, and how it was transferred. Simple notes are far better than nothing.
- Back it up in at least two places, unmodified.
- Take supporting photos at the time: wider context shots, a newspaper or phone screen showing the date, identifiable landmarks. These corroborate what metadata alone cannot.
If You're Evaluating Someone Else's Photo
Ask for the original file, not a forwarded copy or screenshot. Check whether metadata is present and internally consistent. Compare the claimed time and place against independent evidence. And remember that absence of metadata usually means the file has passed through a platform — not that someone is hiding something.
For anything genuinely consequential, involve a professional early. Forensic examiners have both methodology and standing that self-collected evidence usually lacks.