When a photo matters to a case, the question is often not what it shows but when and where it was taken. The answer may be sitting inside the image file as EXIF metadata: the capture date and time, the device that took it, and sometimes GPS coordinates. It may also have been silently stripped the moment the client texted the photo to your office.
This guide is for litigation teams that need photo metadata evidence to survive the trip from a client’s phone to an exhibit. It covers what the common fields actually show, how metadata gets lost, how to collect originals with metadata intact, how to extract and read it correctly, how it supports authentication, and the privacy risks that come with it. Practices and rules vary by jurisdiction; the federal rules are cited as a reference point.
What does photo metadata actually show?
EXIF is a standard for storing information inside image files. Phones and cameras write it automatically at capture. The fields that matter most in litigation:
| Field | What it tells you | Caveat |
|---|---|---|
| Date/time original | When the camera recorded the image | Usually local time with no zone unless an offset field is present |
| Offset time original | The UTC offset at capture | Not written by every device or app |
| GPS latitude, longitude, altitude | Where the device believed it was | Absent if location was off; accuracy varies |
| GPS date and time stamp | Time from the location fix, recorded in UTC | Can differ slightly from the capture time |
| Make and model | The device that took the photo | Identifies a model, not a specific phone |
| Software | Firmware or the app that last saved the file | An editing app name suggests the file was re-saved |
| Modify date | When the file was last changed by software | Differs from capture date after edits |
File system dates, the “created” and “modified” dates your computer shows, are different from EXIF dates. They usually reflect when the file was copied to that computer, not when the photo was taken. Exhibits and declarations should not confuse the two.
How does photo metadata get lost or changed?
Usually in transit, and usually without anyone noticing. Common causes:
- Texting and messaging apps. Many compress images and strip or rewrite metadata when sending.
- Social media uploads. Platforms commonly remove EXIF from publicly served images, so a downloaded post image rarely has original data.
- Email resizing. Phone mail apps often offer to shrink attachments, and the smaller copy may lose metadata.
- Screenshots. A screenshot is a new image with its own metadata. The original capture details are gone.
- Editing. Cropping, filters and markup tools re-save the file and can change or drop fields.
- Privacy share settings. Phones may let users remove location when sharing, which is useful for privacy and a problem for evidence.
- Cloud downloads. Some services deliver compressed copies by default, and some exports place dates and locations in separate sidecar files rather than in the image.
How do you collect original photos with metadata intact?
Go to the source, use a transfer method that copies files rather than re-encoding them, and record what you did. The sequence:
- Identify the source. The phone’s camera roll, a cloud photo library, a camera’s memory card, or a shared album. Note which one holds the earliest copy.
- Choose a faithful transfer. Options include a desktop export that keeps the unmodified original, a cable import to a computer, a cloud export that includes originals and any sidecar files, or a forensic or backup tool for larger collections.
- Keep sidecar files with their images. If an export splits metadata into separate files, preserve both together and record the pairing.
- Hash on arrival. Record a SHA-256 value for each original before anyone opens or converts it. Evidence Helper normalizes HEIC images for review while preserving each original file untouched with a SHA-256 hash recorded on arrival, so reviewers never work on the only copy.
- Extract metadata to a report. Generate a metadata report for each original and preserve the report alongside it.
- Work from copies. Exhibits, crops and enlargements come from copies; the original stays as collected.
Sample client instructions
Please do not text, email or post the photos we discussed, and please do not edit, crop or delete them. Leave them in your phone’s photo library. We will arrange to copy the original files directly from your phone or photo account so the date and location information stays intact. If any photos have already been deleted, tell us; there may be a recently deleted folder or cloud backup we can check.
How do you extract and read EXIF data correctly?
Use a tool that reports every field, save its output, and interpret dates with care. Operating-system “info” panels show only a subset. ExifTool, a widely used free command-line utility, prints the full set; a command such as exiftool -a -u -g1 photo.heic > photo_metadata.txt writes all tags, grouped by type, to a text file you can preserve and hash.
Reading the output correctly matters more than extracting it:
- Check whether an offset field exists before converting capture time to any time zone
- Compare the capture time with the GPS time stamp, which is in UTC, as a cross-check
- Look at the Software and Modify Date fields for signs of editing
- Compare make and model against the device the witness says took the photo
- Note fields that are missing, and why that might be (privacy settings, app behavior, transfer method)
- Check consistency across a set: photos from one event should show plausible sequences of time and location
How does metadata support authentication?
As corroboration. Under Federal Rule of Evidence 901, a photo is commonly authenticated by a witness with knowledge testifying that it fairly and accurately depicts the scene, under Rule 901(b)(1). Metadata strengthens that foundation in several ways:
- Distinctive characteristics, Rule 901(b)(4). Dates, locations and device details consistent with the witness’s account.
- Process or system, Rule 901(b)(9). Evidence that the device records accurate time and location data.
- Certified copies, Rule 902(14). Data copied from a device or file can be self-authenticating with a certification from a qualified person that the copy was verified by a process of digital identification, typically a hash, subject to the notice requirements of Rule 902(11).
Metadata cannot carry the whole load. It can be edited, devices can have wrong clocks, and location fixes can be imprecise. Pair it with testimony and other records, and keep the collection documented; see chain of custody for digital evidence and hash values in litigation. For injury and property matters, the personal injury photo evidence guide shows how metadata fits into a larger photo set.
What are the privacy risks of photo metadata?
GPS coordinates in a photo can reveal where a person lives, works, or is staying. In family law, harassment and protective order matters, that can put a client at real risk, and it can expose children’s locations as well.
- Before filing or producing photos, review metadata for location and other identifying fields.
- Federal Rule of Civil Procedure 5.2 lists specific identifiers for redaction in federal filings but does not address location data directly; protective orders and sealing are the usual tools for sensitive natives.
- Where metadata is relevant but sensitive, discuss production of natives under a protective order rather than stripping fields unilaterally.
- When fields are removed from a filed copy, document exactly what was removed and keep the original preserved. The approach in redacting exhibits applies to metadata too.
What mistakes undermine photo metadata evidence?
The recurring problems are procedural, not technical:
- Relying on photos the client texted or emailed to the firm
- Citing the computer’s file date as the date the photo was taken
- Converting times without checking for an offset field
- Opening and re-saving originals in an editor before hashing
- Producing images with a client’s home location embedded
- Treating metadata as proof by itself, with no witness to connect it to the scene
Whether metadata comes in, and how much weight it carries, is for the attorney handling the matter to assess under the rules where the case is pending. This article is general information, not legal advice. The collection steps above make sure the data is still there when that assessment happens.
