Analysis of errors in exif metadata on mobile devices

Nowadays the number of cameras integrated on mobile phones is growing very

fast, making it essential to design new specific forensic analysis techniques aimed towards

the pictures created with these devices. Most of these phones automatically add relevant

Exif metadata in the process of image acquisition. This metadata, even if it is vulnerable to

tampering, can be very helpful for a variety of forensic analysis techniques. That is why the

existence of efficient, robust and specialised tools is a necessity. These should allow metadata

to be extracted in a consistent, fast and sound way. Besides, metadata extraction must

never manipulate the image and it needs to take into account possible departures from the

Exif specification, including the insertion of the metadata in the image acquisition process

by the makers, as well as any modification, whether malicious or not. This paper will show

the multiple anomalies in the Exif specification we have found during our study, which can

produce serious problems in classical tools for the extraction of image metadata, including

crashes and wrong results, and even interoperability problems among different devices.

We will also show some anomalies found in the operation of different well-known forensic

tools.