- [Instructor] Metadata that's embedded within files
is extremely important
in a number of fields and applications.
Image metadata is often the first to come to mind
when we think about this kind of metadata,
but other media and formats
often use embedded metadata as well.
Here, for example, I have a photo that I took recently.
I encourage you to explore your own photos.
In most photo viewing applications,
we can find an information or detail area
to show us some of the metadata attached to a photo.
I'll open up the file info, and here on the right,
I can see camera information and location information.
This photo was taken in Rome
with my iPhone 13 Pro in April of 2022.
This sort of metadata is defined by a standard called EXIF,
which is short for Exchangeable Image File format.
There are dozens of standard tags
that might be applied to any photo created by any camera,
for example, that can be read in a standard way
by other devices and systems.
This standard allows tools to work
with the metadata information of files.
There's also another set of metadata
which is mostly supported within EXIF called IPTC.
This standard has also been extended to XMP
or Extensible Metadata Platform.
Depending on the type, age, origin, and purpose of a file,
it may have metadata in all of these formats,
some of them, or none of them.
It's common, for example, for a photo management tool
to allow us to search or create albums based on metadata.
I could search to find all the photos
taken with a particular lens or at a particular location
if my camera supports adding GPS information to photos.
Some audio and other media file formats use EXIF
and related tags as well.
While this kind of metadata is useful within applications,
it's also useful outside of applications
because many tools can read
standard embedded metadata formats.
As we'll see later in the course,
many system-wide file search tools
can build their own index of metadata
and use that to search for files quickly.
There are also software tools like ExifTool
which allow us to read and modify metadata in files
without having to open up a photo editor,
or an audio player, or a document browser,
or whichever specialized application
we might use a file's metadata within.
One thing to be aware of when working
with embedded metadata, though,
is that, generally speaking, there's no guarantee
that any of the values are true or correct.
When I travel with my interchangeable lens camera
which doesn't have internet access or a built-in GPS,
I almost always forget to set
its time zone and date correctly,
so when I come back home from my travels,
I need to modify the date and time of these photos.
Some tools make it easy to simply offset
the existing time by a set number of hours
if we simply forgot to change the time zone,
and sometimes we'll need to make extremely specific changes
if the recorded date and time are way off.
I also often add approximate GPS information
lifted from photos I took with my smartphone
around the same location or from mapping software
after I've found a specific location.
Editing the metadata like this
allows my photo browsing software
to present all of my photos on its handy map
and show them in correct chronological order.
Changing metadata for my personal use in this way is useful,
honest, and non-harmful,
but we can set metadata values to anything we'd like,
so the embedded metadata values we read from files
aren't guaranteed to always be truthful,
accurate, or correct.
The information can be maliciously falsified,
accidentally changed, or, as happens with my travel camera,
simply incorrect to begin with,
so if we rely on metadata for forensic purposes
or anything of consequence,
we need to be careful to validate the data
and not simply trust it uncritically.
Some file formats, though, usually documents,
store their own internal metadata
that can be verified and audited,
and this sort of metadata usually can't be read
or changed from outside of the application
that creates and edits the files.
These values are usually chain of custody records,
audit or review trails, or change-tracking information.
Often, documents like this
will also include cryptographic signatures
that can be independently verified.
Embedded metadata values are often called tags,
and that's a helpful way to think about them.
They're simply information attached to the data of a file,
and they can be changed or removed
without altering the actual data of a file.
For example, consider this mug.
I've added tags that describe various properties of it.
It's red, it's made of metal,
and should not be put in the microwave.
Even though we can learn these things
simply by looking at the mug itself,
sometimes it's useful to have this kind of information
specifically listed in a way that we can access.
Tags also give us the ability
to attach other non self-evident information
to an object or file.
While these tags in this photo are separate from
but attached to the object,
file metadata is often included in the file itself.
When tags are embedded within a file,
they are part of the file,
but a file with embedded metadata also has a data component
that represents the actual contents
or information of the file, not including the metadata.
In an image file, for example,
there's binary data that represents the photo itself,
and that's separate from the part of the file
where the metadata is stored.
I also want to point out that some embedded metadata values
are intrinsically representative of the data itself,
like image dimensions or format information.
We could strip this metadata from the file,
but the actual image is still encoded
in whatever format it originally was, like JPEG or PNG,
and it still resolves to the same 1920 pixels wide
by 1080 pixels tall, and so on.
This metadata can be regenerated from the data itself,
and changing these metadata values
doesn't alter the image's actual format or size.
When working with metadata, it's also useful to know
about a few interesting values we might find.
One of these is the Unix epoch start time,
the time when time began,
at least according to Unix and Linux computers.
That's January 1st, 1970 in the UTC time representation,
and that time is kept by counting seconds since then.
This date is important to know about
because it often appears when the real date
and time are missing.
Instead of leaving the date or time field blank,
some software wants to put in a value,
and if the value is zero,
that usually resolves to this special date.
Sometimes we'll also see December 31st, 1969,
which is how the date can render
in time zones west of the prime meridian
when the date value is set to the epoch start.
While some events certainly did happen on this date,
most files we'll use in modern times didn't exist then.
We'll also sometimes see other erroneous dates.
For example, I was going through an old archive
and found files with the year 2036,
14 years in the future of when I'm recording this.
These files definitely weren't from the future, though,
because I burned those archive CDs almost 20 years ago,
so something happened,
maybe a little bit of data corruption.
It's always useful to check metadata for reasonableness.
Another value that results from putting zero in a field
is the location zero degrees north, zero degrees east,
where the equator and prime meridian meet.
That's a point on the globe
in the water off the coast of West Africa,
and it's commonly referred to as Null Island.
Like with our strange times before,
this is a valid location,
and there are probably photos taken precisely there.
There's even a little weather buoy at that spot
to mark the location, but in most photos and other media,
the coordinates of Null Island in location fields
indicate a missing value
that was replaced sometime along the way with zeros.
Embedded metadata is extremely useful,
and we can correct it and add our own,
but it can also contain incorrect information,
so it's important to double-check it before relying on it.
Next, let's take a look at using the ExifTool software
that I mentioned earlier to work with a file's metadata.