Image file system c...
 
Notifications
Clear all

Image file system created time and EXIF time mismatch

15 Posts
6 Users
0 Likes
1,239 Views
(@twjolson)
Posts: 417
Honorable Member
Topic starter
 

I have a Blackberry microSD card that I am examining, and I noticed something odd with the file system times and EXIF times.

The file system records a created time of 110018am.

The EXIF DateTimeOriginal records a time of 113306.

Can anyone explain how the file was created half an hour prior to the EXIF data (and the picture, presumably) being recorded?

Sampling a few others images showed discrepancies, but those were closer to an hour.

 
Posted : 01/12/2012 2:05 am
jhup
 jhup
(@jhup)
Posts: 1442
Noble Member
 

Possible software interpretation issue of the data?

I would test both the file timestamp with various applications, and the same with the EXIF data.

I would also make baseline images, that may reveal if there is such issues.

Have you looked at the raw data within the file itself, and manually converted it to date/time? Same for the FAT?

 
Posted : 01/12/2012 9:03 am
(@twjolson)
Posts: 417
Honorable Member
Topic starter
 

I already tested this, going beyond the tools and viewing the hex. The conundrum still exists.

 
Posted : 01/12/2012 10:32 am
(@mscotgrove)
Posts: 938
Prominent Member
 

Is the create time on the sD card, or are you looking at the file on a PC?

When you copy a file to a hard drive through windows, the modify time is retained, but the create time is time of the copy.

Is the modified time the same or different?

Was the photo rotated or changed in the camera?

 
Posted : 01/12/2012 12:51 pm
(@athulin)
Posts: 1156
Noble Member
 

The file system records a created time of 110018am.

The EXIF DateTimeOriginal records a time of 113306.

Can anyone explain how the file was created half an hour prior to the EXIF data (and the picture, presumably) being recorded?

Not necessarily in your particular case. But in general …

Typically the creation time is relevant for the file, not for its contents. So … can you overwrite an existing file with new contents? If that is possible, you might get an 'old' file creation time with a 'new' exif date.

Can you run local operations on the image? Do those keep original time stamps or do they change them?

Additionally, the timestamps may come from different sources that are not in synch – that would mean the card had moved from one device to another.

 
Posted : 01/12/2012 12:53 pm
(@twjolson)
Posts: 417
Honorable Member
Topic starter
 

The file system records a created time of 110018am.

The EXIF DateTimeOriginal records a time of 113306.

Can anyone explain how the file was created half an hour prior to the EXIF data (and the picture, presumably) being recorded?

Not necessarily in your particular case. But in general …

Typically the creation time is relevant for the file, not for its contents. So … can you overwrite an existing file with new contents? If that is possible, you might get an 'old' file creation time with a 'new' exif date.

Can you run local operations on the image? Do those keep original time stamps or do they change them?

Additionally, the timestamps may come from different sources that are not in synch – that would mean the card had moved from one device to another.

Yes, I don't think this is the case here.

The files in question were created by the device, based on the EXIF make and model fields. They did not have a second blackberry of this model. And even if they moved it from one device to another, wouldn't the file creation and EXIF DateTimeOriginal be the same anyways, regardless?

If the file's contents (the picture taken) were created and then saved to the microSD card after a delay, I would assume the EXIF to predate the file's MAC times, not the other way around.

As for overwriting the file with new contents, that is not the type of behavior I would expect from a smartphone camera. If they took a new picture, it would get a new file name and entry, not overwrite an old one (this becomes less likely when seeing the same behavior in several other spot-checked images). If they went in and edited the image, the EXIF and file's Creation time should remain the same.

I shall try various edits to the image, but again, I would assume that anything that might update the EXIF would cause it to be updated to something after the file's creation date, not predate it.

Thank you greatly for the reply, it is getting me thinking more and more, and opening up new ideas.

 
Posted : 02/12/2012 1:06 am
(@mscotgrove)
Posts: 938
Prominent Member
 

You said other files were closer to 1 hour different.

Was this in UK in the summer, ie is one displaying GMT and other BST?

Am I correct that FAT32 does not have a time zone flag? (My personal time zone flag says it is too late at night to check carefully!!)

 
Posted : 02/12/2012 3:55 am
(@twjolson)
Posts: 417
Honorable Member
Topic starter
 

You said other files were closer to 1 hour different.

Was this in UK in the summer, ie is one displaying GMT and other BST?

Am I correct that FAT32 does not have a time zone flag? (My personal time zone flag says it is too late at night to check carefully!!)

No, the device was in the United States, and did not travel between two time zones.

FAT32 does not have any sort of mechanism for tracking time zones. The time is stored as local time, whatever that might be on the devices clock.

 
Posted : 02/12/2012 5:22 am
(@trewmte)
Posts: 1877
Noble Member
 

twjolson do you still have access to the BB? If so, can you confirm whether it has the security setting 'time-out' set for x-seconds or x-minutes. An issue that has been noted in the past (2009) with BB and Exif regarding conflicting timestamps when the time-out is set.

 
Posted : 02/12/2012 12:26 pm
Beetle
(@beetle)
Posts: 318
Reputable Member
 

twjolson do you still have access to the BB? If so, can you confirm whether it has the security setting 'time-out' set for x-seconds or x-minutes. An issue that has been noted in the past (2009) with BB and Exif regarding conflicting timestamps when the time-out is set.

Is there a reference for this? I'd like to add it to my reference material.

 
Posted : 02/12/2012 6:17 pm
Page 1 / 2
Share: