±Forensic Focus Partners

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 1
New Yesterday: 2
Overall: 27354
Visitors: 47

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Cell Phone Camera Pictures

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2  Next 
  

Cell Phone Camera Pictures

Post Posted: Thu Mar 22, 2007 5:46 pm

I recently acquired some photos taken and stored on an LG VX5300 phone, looked at them in WinHex and ExifViewer, and was unable to find any EXIF data associated with the pictures taken by the camera in the phone. There are a couple of images on there that appear to be desktop images that came with the phone, and they have EXIF data, so it couldn't have been that the photos used to have EXIF data, but it was lost in the acquisition. Are there any special programs or methods out there for viewing EXIF data specific to cell phone photos?

Also, interestingly enough, it appears that the date and time that a photo is taken may be stored in the filename; they are stored with filenames like 1022051508.jpg, 1115051013.jpg, 1115051014.jpg, etc, implying October 22, 2005 at 3:08 PM for the first one. However, I have no conclusive proof that this is indeed how the phone names the images. The only way I can think of proving this is to buy another identical phone and take some pictures with it, noting the actual date/time they are taken. Any other ideas?  

forensic_ryan
Newbie
 
 
  

Re: Cell Phone Camera Pictures

Post Posted: Thu Mar 22, 2007 8:06 pm

Are you sure they were taken with the VX5300? Or just stored there (perhaps downloaded there)? I just did some tests, albeit not scientific.

1. Took pics with Motorola 815 (sorry, none of my LG phones have cameras). Header info on both shows:
ÿØÿá.ÆExif..MM.*............. ...n...........x.....................................(.......................i..............Motorola..1.3 Megapixel....H.......H.................h........0220....

Exif Viewer shows:
Exif IFD0

* Camera Make = Motorola
* Camera Model = 1.3 Megapixel
* Picture Orientation = normal (1)
* X-Resolution = 72/1 = 72.00
* Y-Resolution = 72/1 = 72.00
* X/Y-Resolution Unit = inch (2)
* Y/Cb/Cr Positioning (Subsampling) = centered / center of pixel array (1)

Exif Sub IFD

* Exposure Time (1 / Shutter Speed) = 1/21 second = 0.04762 second
* Exif Version = 0220
* Original Date/Time = 2006:11:20 17:11:06
* Digitization Date/Time = 2006:11:20 17:11:06
* Components Configuration = 0x01,0x02,0x03,0x00 / YCbCr
* Flash = Flash did not fire
* FlashPix Version = 0100
* Color Space = sRGB (1)
* Image Width = 320
* Image Height = 240
* Custom Rendered = normal process (0)
* Exposure Mode = auto exposure (0)
* White Balance = auto (0)
* Digital Zoom Ratio = 4505/4096 = 1.10
* Scene Capture Type = standard (0)
* Subject Distance Range = unknown (0)

Exif Interoperability IFD

* Interoperability Index = R98
* Interoperability Version = 0100



2. Opened the files in Photoshop, made different changes to each pic and saved. Header info changed to:
ÿØÿà..JFIF.....H.H..ÿá.¯Exif..MM.*.....
....... ...................................................¥.(...........1.........­.2.........É.............i.........à... Motorola.1.3 Megapixel..
ü...'..
ü...'.Adobe Photoshop CS2 Windows.2007:03:22 21:07:15......

Exif Viewer shows:
Exif IFD0

* Camera Make = Motorola
* Camera Model = 1.3 Megapixel
* Picture Orientation = normal (1)
* X-Resolution = 720000/10000 = 72.00
* Y-Resolution = 720000/10000 = 72.00
* X/Y-Resolution Unit = inch (2)
* Software/Firmware Version = Adobe Photoshop CS2 Windows
* Last Modified Date/Time = 2007:03:22 21:07:15
* Y/Cb/Cr Positioning (Subsampling) = centered / center of pixel array (1)

Exif Sub IFD

* Exposure Time (1 / Shutter Speed) = 1/21 second = 0.04762 second
* Exif Version = 0220
* Original Date/Time = 2006:11:20 17:11:06
* Digitization Date/Time = 2006:11:20 17:11:06
* Components Configuration = 0x01,0x02,0x03,0x00 / YCbCr
* Flash = Flash did not fire
* FlashPix Version = 0100
* Color Space = sRGB (1)
* Image Width = 320
* Image Height = 240
* Custom Rendered = normal process (0)
* Exposure Mode = auto exposure (0)
* White Balance = auto (0)
* Digital Zoom Ratio = 4505/4096 = 1.10
* Scene Capture Type = standard (0)
* Subject Distance Range = unknown (0)

Exif IFD1

* Compression = JPEG compression (6)
* X-Resolution = 72/1 = 72.00
* Y-Resolution = 72/1 = 72.00
* X/Y-Resolution Unit = inch (2)
* Offset to the start byte (SOI) of JPEG compressed thumbnail data = 618
* JPEG Interchange Format Length = 4157

Exif Interoperability IFD

* Interoperability Index = R98
* Interoperability Version = 0100



3. Opened same pics in Paint, made different changes to each pic and saved. Header info changed to:
ÿØÿà..JFIF.....`.`..ÿá..Exif..II*........... ...¶...........À.......................Î...........Ö...(.......................i.......æ....¤...........¤...........¤...........¤......Þ....¤.......... ¤..............Motorola..1.3 Megapixel.H.......H...........

Exif Viewer shows:
Exif IFD0

* Camera Make = Motorola
* Camera Model = 1.3 Megapixel
* Picture Orientation = normal (1)
* X-Resolution = 72/1 = 72.00
* Y-Resolution = 72/1 = 72.00
* X/Y-Resolution Unit = inch (2)
* Y/Cb/Cr Positioning (Subsampling) = centered / center of pixel array (1)
* Custom Rendered = normal process (0)
* Exposure Mode = auto exposure (0)
* White Balance = auto (0)
* Digital Zoom Ratio = 4505/4096 = 1.10
* Scene Capture Type = standard (0)
* Subject Distance Range = unknown (0)

(unable to display the specified text)


4. Opened pics in Macromedia Fireworks MX 2004, made some changes to each pic and saved. Header info changed to:
ÿØÿà..JFIF.....H.H..ÿÛ.C..................................................
ÿÛ.C........... .
ÿÀ....ð.@.........
(notice that the Exif info is gone)

Exif viewer shows:
Skipping APPx (0xe0) block
Bad JPEG file head, APP1 (Exif) marker not found: 0xff 0xdb
Status = -1

Unable to extract all the Exif data.


5. I used the utilities on the phone and made what limited changes I could, but the Exif data still retained the Motorola info.



I would certainly be interested if anyone has a VX5300 in the time date stamp subject and any similar experimentation.  

BitHead
Senior Member
 
 
  

Re: Cell Phone Camera Pictures

Post Posted: Fri Mar 23, 2007 9:17 am

I fired off an email to LG:

When a picture is taken with the LG VX5300 phone's built-in digital camera, does the filename correspond to the date/time of when the picture was taken? For example, if the picture's name was "1022051306.jpg", would that mean the picture was taken on October 22, 2005 at 1:06 PM?


And they replied with:

Yes. The default file name convention is month, day and time for the picture taken.


So, since the filenames were stored in the format the VX5300 is supposed to store filenames, they were probably taken with the phone's camera and not downloaded there. I'm not 100% sure this is the case, of course.  

forensic_ryan
Newbie
 
 
  

Re: Cell Phone Camera Pictures

Post Posted: Fri Mar 23, 2007 11:58 am

Which begs the question: what happened on the phone to delete the Exif info? Is there a program or function on the phone that would obfuscate the info? Were the files on a memory card or on the phone? Perhaps they were synced with BitPim or similar.

I am certainly interested in how this progresses, we run into more and more cell phones.  

BitHead
Senior Member
 
 
  

Re: Cell Phone Camera Pictures

Post Posted: Fri Mar 23, 2007 12:23 pm

I think it's common for phone cameras to name picture files with that convention. What happenes to the EXIF data if some other camera takes the picture and then sends it to your suspect camera? Does all of the data remain intact or is something lost in the transmission?
_________________
Jerry Nicholson, Owner
Mlink.com
www.mlink.com 

OldDawg
Senior Member
 
 
  

Re: Cell Phone Camera Pictures

Post Posted: Tue Mar 27, 2007 2:36 pm

Additionally, some cameras when taking pictures will tack a letter (a-z) at the end of the file name, if the picture was taken within the same minute. I have noticed it on some LG and Samsung models.  

libertate
Senior Member
 
 
  

Re: Cell Phone Camera Pictures

Post Posted: Mon Apr 02, 2007 4:15 pm

Here is the interesting thing (in my experience) with photos and LG phones. Some of their models support the EXIF data and some do not. I was investigating a case where this data was present with the LG VX8100, but not the VX8300 (newer phone). I ran several tests on the phone, but it just plain and simply did not put the EXIF data with the pictures it took like the Vx8100. I think you will need more evidence to honestly say that a certain picture came from a certain phone since this occurs and all LG phones have the same file naming convention, but not all leave EXIF.

If you are LE then subpoena the provider and look for MMS messages sent or received (do the same for email). If the provider still has copies of those pics on the server, get them. Keep in mind that most phones are capable of transferring data via IR or Bluetooth, etc. Just be certain how those pictures got there. You can also look in the phones file structure to see where the photos are stored. This will give you a better idea.

The only way to be 100% is to get a VX5300 and take a picture with it, then examine the picture and see if it puts EXIF data in it. My guess would be it simply is not putting that info there.

To answer OldDawg's question. I have seen "most" pics retain the EXIF data even after being sent to another phone (or elsewhere) via MMS, bluetooth, etc..

Good luck  

BraneRift
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 2
Go to page 1, 2  Next