Photo adjustments are a little bit of a nightmare.
I don't know why you would want to do this.
So I have an example coming up when I did this.
Ian Whiffin wrote a fantastic blog
that you should read about this.
So what Apple does now-- with iOS 15, you take a picture.
You can say, let me pretend I took this in 1980.
So you could change the date to the day you were born in 1980,
you could change the location to Maui,
and it's going to look like that.
I'm going to show you how much of a nightmare
this could be in your investigation.
The original EXIF data is reflected on the device
that took that photo.
So this is very important.
We're going to take a look at what this means.
The user is going to see what they adjusted
it to be in the gallery.
So if they go into their gallery,
they're going to see a date of 1/1/1980,
whatever they changed it to.
But the original is going to exist somewhere.
Now, what happens if you text that?
So if I take a picture, I change it to 1/1/1980
and Maui, if I text it to someone, what you're
going to see is it's going to show the adjusted time
and location.
The receiving phone is really going
to believe it and say, oh, wow, Heather was in Maui in 1980,
and took a picture of herself in the studio.
That would be crazy.
Can you imagine taking a picture of yourself
with an iPhone in 1980?
It would just not make sense.
ICloud is also going to assume that 1980 and Maui is correct.
Photos.sqlite is impacted for certain things.
The adjusted time is zeroed out.
So this is where this is very important.
If you go and you look at the adjusted time,
there will never be seconds.
That is a clue to you that the person
has messed with that image.
And I know this sounds so crazy, because what if you really
took it at 6:13 exactly?
Then that's, unfortunately, bad luck for you.
But if you look and you see zero seconds consistently,
those photos have been adjusted.
That's your first red flag.