±Partners and Sponsors

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 0
New Yesterday: 4
Overall: 26226
Visitors: 56

±Forensics Europe Expo


±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Image file system created time and EXIF time mismatch

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page Previous  1, 2, 3  Next 
  

Re: Image file system created time and EXIF time mismatch

Post Posted: Sat Dec 01, 2012 7:22 pm

- mscotgrove
You said other files were closer to 1 hour different.

Was this in UK in the summer, ie is one displaying GMT and other BST?

Am I correct that FAT32 does not have a time zone flag? (My personal time zone flag says it is too late at night to check carefully!!)


No, the device was in the United States, and did not travel between two time zones.

FAT32 does not have any sort of mechanism for tracking time zones. The time is stored as local time, whatever that might be on the devices clock.  

twjolson
Senior Member
 
 
  

Re: Image file system created time and EXIF time mismatch

Post Posted: Sun Dec 02, 2012 2:26 am

twjolson do you still have access to the BB? If so, can you confirm whether it has the security setting 'time-out' set for x-seconds or x-minutes. An issue that has been noted in the past (2009) with BB and Exif regarding conflicting timestamps when the time-out is set.
_________________
Institute for Digital Forensics (IDF) - LinkedIn
Mobile Telephone Examination Board (MTEB) - LinkedIn
Mobile Telephone Evidence & Forensics trewmte.blogspot.com
ForensicMobex now MTEB Linkedin Subgroup 

trewmte
Senior Member
 
 
  

Re: Image file system created time and EXIF time mismatch

Post Posted: Sun Dec 02, 2012 8:17 am

- trewmte
twjolson do you still have access to the BB? If so, can you confirm whether it has the security setting 'time-out' set for x-seconds or x-minutes. An issue that has been noted in the past (2009) with BB and Exif regarding conflicting timestamps when the time-out is set.



Is there a reference for this? I'd like to add it to my reference material.  

Beetle
Senior Member
 
 
  

Re: Image file system created time and EXIF time mismatch

Post Posted: Sun Dec 02, 2012 9:28 am

- trewmte
twjolson do you still have access to the BB? If so, can you confirm whether it has the security setting 'time-out' set for x-seconds or x-minutes. An issue that has been noted in the past (2009) with BB and Exif regarding conflicting timestamps when the time-out is set.


Can you please explain this more?

I do have the device, but I am hesitant to manipulate it unless absolutely needed.p  

twjolson
Senior Member
 
 
  

Re: Image file system created time and EXIF time mismatch

Post Posted: Sun Dec 02, 2012 10:27 am

This is where I first read about conflicting date and time stamps

www.blackberryforums.c...phone.html

www.blackberryforums.c...one-2.html



I also noted this 2010 question on my search:

www.blackberryforums.c...-exif.html
_________________
Institute for Digital Forensics (IDF) - LinkedIn
Mobile Telephone Examination Board (MTEB) - LinkedIn
Mobile Telephone Evidence & Forensics trewmte.blogspot.com
ForensicMobex now MTEB Linkedin Subgroup 

trewmte
Senior Member
 
 
  

Re: Image file system created time and EXIF time mismatch

Post Posted: Mon Dec 03, 2012 10:34 am

- trewmte
This is where I first read about conflicting date and time stamps

www.blackberryforums.c...phone.html

www.blackberryforums.c...one-2.html



I also noted this 2010 question on my search:

www.blackberryforums.c...-exif.html


Very illuminating. I shall follow up on this. It appears to be the case, but the time variance they mention aren't as great as some of mine. But, I should be able to prove/disprove based on if the time for one photo is wrong, and the subsequent photos taken right after are right.

Thank you for finding this.  

twjolson
Senior Member
 
 
  

Re: Image file system created time and EXIF time mismatch

Post Posted: Wed Dec 05, 2012 10:01 am

So it is a known issue for the BlackBerry Bold, 8310, 8330 at least, and it has to do with security lock-out.

It appears from the blog write up that at least this is caused by a "frozen EXIF date/time stamp" for the first image after unlock.

That is -
Clock correct in BB
Clock correct in EXIF date/time stamp variable
BB security locks (manual or timeout)
time passes
BB clock updates
EXIF date/time stamp variable stores date/time at time of screen lock and is not updated
BB security unlocks
first picture uses wrong/old at-security-lock date/time for EXIF in image
BB clock updates
EXIF date/time variable updates to correct date/time
all following uses correct date/time


Do I have it correctly?

(corrected link)
 

Last edited by jhup on Wed Dec 05, 2012 2:00 pm; edited 1 time in total

jhup
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 2 of 3
Go to page Previous  1, 2, 3  Next