Metadata alone is not proof.
getty
A photo lands on your desk with a timestamp that matches the story perfectly. Someone points to the metadata like it settles the matter. It does not, and it never did.
Metadata is the information a device writes inside a digital file: when a photo was taken, where, on what camera, with what settings. Think of it as the writing on an envelope. The image is the letter inside, and the envelope tells you who sent it and when.
The envelope has always been written in pencil. Metadata was never completely reliable, because it is data describing other data, and data can be changed. What’s different is how little effort the changing takes. The easier it becomes to alter or lose metadata, even innocently, the less any timestamp can be trusted on its own.
Here are five reasons metadata alone cannot carry the weight of authenticating digital evidence.
Anyone Can Edit Photo Metadata On Their Phone
Open the Photos app on an iPhone, pick a photo and tap Adjust Date & Time. Apple documents how to change the date, the time and the location stored inside any photo or video, one at a time or in batches. On Android, Google documents the same kind of edit in Google Photos, a few taps to give a picture a new date and time, and free metadata editor apps go further. No special software, no technical skill.
Free Tools Rewrite Metadata Fields
ExifTool is a free utility that reads and writes metadata in photos, videos, PDFs and hundreds of other file types. One command shifts every date in a photo. Another wipes every field clean. The tool was built for legitimate work, like photographers fixing camera clocks that were set wrong, and it is excellent at that job. The same capability serves anyone constructing a false record. A date written inside a file is a value someone chose to leave there, nothing more.
Play Puzzles & Games on Forbes
File Transfers Change Metadata Without Anyone Trying
No fraud required for this one. Copy a file to a new drive and it can pick up new file system dates. Save a photo out of an email and the copy can carry the date you saved it, on the machine you saved it to. Many messaging services recompress images to save bandwidth and remove embedded data in the process. Nobody set out to destroy anything. The pipeline just was not built to preserve it.
Screenshots Have No Original Metadata At All
A screenshot is a new file. Its metadata describes the device that captured the screen and the moment of capture. It contains nothing from the original photo, message or document displayed inside it. A screenshot can illustrate what someone saw. It cannot authenticate anything, because it is a derivative, a photocopy of a window. Litigation outcomes are still influenced by screenshots today. That should worry everyone involved.
Deepfakes Turn A Metadata Weakness Into An Evidence Crisis
All five problems existed before generative AI. What deepfakes changed is the payoff for exploiting them. A fabricated image can be dressed in fabricated metadata, and once the file passes through a platform or a screenshot, there is little left to inspect anyway.
Deepfakes broke the assumption that seeing is believing, and metadata is in no condition to repair it. The industry answer is cryptographically signed provenance data from the Coalition for Content Provenance and Authenticity, or C2PA. That standard is real progress, and even the coalition acknowledges that credentials can be removed from a file accidentally or intentionally.
This reaches far past photos. Word documents, PDFs, spreadsheets, voice recordings and video files all carry metadata. All of it can be edited, stripped or lost the same ways.
Device-Level Digital Forensics Is Where Proof Lives
So where does that leave a disputed file? At the device that supposedly created it.
A digital forensic examination of the phone or computer alleged to have taken a photo works back toward that source, and it reads much more than the envelope. The file exists inside a web of system databases, application records and logs, thousands of interlocking traces that would be extremely challenging to fake.
Best practices for image authentication published by the Scientific Working Group on Digital Evidence direct examiners to analyze both the content of an image and its underlying structure. The group’s own guidance notes that metadata “can be limited, absent, or altered.” When the device’s records agree with the file’s story, that supports authenticity. When they conflict, the story fails authentication.
Detection tools have a place, and they return probability scores, a likelihood that a file is synthetic. Device-level examination is different. It can deliver true proof that a file is authentic, grounded in records no upload pipeline ever touched.
Metadata still matters as a starting point, a lead worth running down. Treating it as proof was always a mistake, and the mistake gets more problematic every year. If you make decisions based upon digital documents, remember that the next disputed photo that lands on your desk will look clean, and its metadata will look clean too. That is exactly the problem.
Social Media Uploads Strip EXIF Data
The International Press Telecommunications Council, the standards body behind news photo metadata, has run tests for years on what platforms do to EXIF data, the embedded metadata block cameras write inside photos. In the most recent published round, photos saved back off Facebook and Twitter, now X, lost some or all of their embedded metadata, and Instagram displayed none at all. The version of a photo pulled off social media, which is exactly where disputed photos tend to come from, arrives with its history already gone.