Cell Phone Camera P...
 
Notifications
Clear all

Cell Phone Camera Pictures

12 Posts
8 Users
0 Likes
2,003 Views
(@forensic_ryan)
Posts: 5
Active Member
Topic starter
 

I recently acquired some photos taken and stored on an LG VX5300 phone, looked at them in WinHex and ExifViewer, and was unable to find any EXIF data associated with the pictures taken by the camera in the phone. There are a couple of images on there that appear to be desktop images that came with the phone, and they have EXIF data, so it couldn't have been that the photos used to have EXIF data, but it was lost in the acquisition. Are there any special programs or methods out there for viewing EXIF data specific to cell phone photos?

Also, interestingly enough, it appears that the date and time that a photo is taken may be stored in the filename; they are stored with filenames like 1022051508.jpg, 1115051013.jpg, 1115051014.jpg, etc, implying October 22, 2005 at 308 PM for the first one. However, I have no conclusive proof that this is indeed how the phone names the images. The only way I can think of proving this is to buy another identical phone and take some pictures with it, noting the actual date/time they are taken. Any other ideas?

 
Posted : 23/03/2007 3:46 am
(@bithead)
Posts: 1206
Noble Member
 

Are you sure they were taken with the VX5300? Or just stored there (perhaps downloaded there)? I just did some tests, albeit not scientific.

1. Took pics with Motorola 815 (sorry, none of my LG phones have cameras). Header info on both shows
ÿØÿá.ÆExif..MM.*…………. …n………..x……………………………….(…………………..i…………..Motorola..1.3 Megapixel….H…….H……………..h……..0220….

Exif Viewer shows
Exif IFD0

* Camera Make = Motorola
* Camera Model = 1.3 Megapixel
* Picture Orientation = normal (1)
* X-Resolution = 72/1 = 72.00
* Y-Resolution = 72/1 = 72.00
* X/Y-Resolution Unit = inch (2)
* Y/Cb/Cr Positioning (Subsampling) = centered / center of pixel array (1)

Exif Sub IFD

* Exposure Time (1 / Shutter Speed) = 1/21 second = 0.04762 second
* Exif Version = 0220
* Original Date/Time = 20061120 171106
* Digitization Date/Time = 20061120 171106
* Components Configuration = 0x01,0x02,0x03,0x00 / YCbCr
* Flash = Flash did not fire
* FlashPix Version = 0100
* Color Space = sRGB (1)
* Image Width = 320
* Image Height = 240
* Custom Rendered = normal process (0)
* Exposure Mode = auto exposure (0)
* White Balance = auto (0)
* Digital Zoom Ratio = 4505/4096 = 1.10
* Scene Capture Type = standard (0)
* Subject Distance Range = unknown (0)

Exif Interoperability IFD

* Interoperability Index = R98
* Interoperability Version = 0100

2. Opened the files in Photoshop, made different changes to each pic and saved. Header info changed to
ÿØÿà..JFIF…..H.H..ÿá.¯Exif..MM.*…..
……. ……………………………………………Â¥.(………..1………­.2………É………….i………à…Motorola.1.3 Megapixel..
ü…'..
ü…'.Adobe Photoshop CS2 Windows.20070322 210715……

Exif Viewer shows
Exif IFD0

* Camera Make = Motorola
* Camera Model = 1.3 Megapixel
* Picture Orientation = normal (1)
* X-Resolution = 720000/10000 = 72.00
* Y-Resolution = 720000/10000 = 72.00
* X/Y-Resolution Unit = inch (2)
* Software/Firmware Version = Adobe Photoshop CS2 Windows
* Last Modified Date/Time = 20070322 210715
* Y/Cb/Cr Positioning (Subsampling) = centered / center of pixel array (1)

Exif Sub IFD

* Exposure Time (1 / Shutter Speed) = 1/21 second = 0.04762 second
* Exif Version = 0220
* Original Date/Time = 20061120 171106
* Digitization Date/Time = 20061120 171106
* Components Configuration = 0x01,0x02,0x03,0x00 / YCbCr
* Flash = Flash did not fire
* FlashPix Version = 0100
* Color Space = sRGB (1)
* Image Width = 320
* Image Height = 240
* Custom Rendered = normal process (0)
* Exposure Mode = auto exposure (0)
* White Balance = auto (0)
* Digital Zoom Ratio = 4505/4096 = 1.10
* Scene Capture Type = standard (0)
* Subject Distance Range = unknown (0)

Exif IFD1

* Compression = JPEG compression (6)
* X-Resolution = 72/1 = 72.00
* Y-Resolution = 72/1 = 72.00
* X/Y-Resolution Unit = inch (2)
* Offset to the start byte (SOI) of JPEG compressed thumbnail data = 618
* JPEG Interchange Format Length = 4157

Exif Interoperability IFD

* Interoperability Index = R98
* Interoperability Version = 0100

3. Opened same pics in Paint, made different changes to each pic and saved. Header info changed to
ÿØÿà..JFIF…..`.`..ÿá..Exif..II*……….. …¶………..À…………………..ÃŽ………..Ö…(…………………..i…….æ….¤………..¤………..¤………..¤……Þ….¤……….¤…………..Motorola..1.3 Megapixel.H…….H………..

Exif Viewer shows
Exif IFD0

* Camera Make = Motorola
* Camera Model = 1.3 Megapixel
* Picture Orientation = normal (1)
* X-Resolution = 72/1 = 72.00
* Y-Resolution = 72/1 = 72.00
* X/Y-Resolution Unit = inch (2)
* Y/Cb/Cr Positioning (Subsampling) = centered / center of pixel array (1)
* Custom Rendered = normal process (0)
* Exposure Mode = auto exposure (0)
* White Balance = auto (0)
* Digital Zoom Ratio = 4505/4096 = 1.10
* Scene Capture Type = standard (0)
* Subject Distance Range = unknown (0)

(unable to display the specified text)

4. Opened pics in Macromedia Fireworks MX 2004, made some changes to each pic and saved. Header info changed to
ÿØÿà..JFIF…..H.H..ÿÛ.C…………………………………………..
ÿÛ.C……….. .
ÿÀ….ð.@………
(notice that the Exif info is gone)

Exif viewer shows
Skipping APPx (0xe0) block
Bad JPEG file head, APP1 (Exif) marker not found 0xff 0xdb
Status = -1

Unable to extract all the Exif data.

5. I used the utilities on the phone and made what limited changes I could, but the Exif data still retained the Motorola info.

I would certainly be interested if anyone has a VX5300 in the time date stamp subject and any similar experimentation.

 
Posted : 23/03/2007 6:06 am
(@forensic_ryan)
Posts: 5
Active Member
Topic starter
 

I fired off an email to LG

When a picture is taken with the LG VX5300 phone's built-in digital camera, does the filename correspond to the date/time of when the picture was taken? For example, if the picture's name was "1022051306.jpg", would that mean the picture was taken on October 22, 2005 at 106 PM?

And they replied with

Yes. The default file name convention is month, day and time for the picture taken.

So, since the filenames were stored in the format the VX5300 is supposed to store filenames, they were probably taken with the phone's camera and not downloaded there. I'm not 100% sure this is the case, of course.

 
Posted : 23/03/2007 7:17 pm
(@bithead)
Posts: 1206
Noble Member
 

Which begs the question what happened on the phone to delete the Exif info? Is there a program or function on the phone that would obfuscate the info? Were the files on a memory card or on the phone? Perhaps they were synced with BitPim or similar.

I am certainly interested in how this progresses, we run into more and more cell phones.

 
Posted : 23/03/2007 9:58 pm
(@olddawg)
Posts: 108
Estimable Member
 

I think it's common for phone cameras to name picture files with that convention. What happenes to the EXIF data if some other camera takes the picture and then sends it to your suspect camera? Does all of the data remain intact or is something lost in the transmission?

 
Posted : 23/03/2007 10:23 pm
(@Anonymous)
Posts: 0
Guest
 

Additionally, some cameras when taking pictures will tack a letter (a-z) at the end of the file name, if the picture was taken within the same minute. I have noticed it on some LG and Samsung models.

 
Posted : 28/03/2007 1:36 am
(@branerift)
Posts: 59
Trusted Member
 

Here is the interesting thing (in my experience) with photos and LG phones. Some of their models support the EXIF data and some do not. I was investigating a case where this data was present with the LG VX8100, but not the VX8300 (newer phone). I ran several tests on the phone, but it just plain and simply did not put the EXIF data with the pictures it took like the Vx8100. I think you will need more evidence to honestly say that a certain picture came from a certain phone since this occurs and all LG phones have the same file naming convention, but not all leave EXIF.

If you are LE then subpoena the provider and look for MMS messages sent or received (do the same for email). If the provider still has copies of those pics on the server, get them. Keep in mind that most phones are capable of transferring data via IR or Bluetooth, etc. Just be certain how those pictures got there. You can also look in the phones file structure to see where the photos are stored. This will give you a better idea.

The only way to be 100% is to get a VX5300 and take a picture with it, then examine the picture and see if it puts EXIF data in it. My guess would be it simply is not putting that info there.

To answer OldDawg's question. I have seen "most" pics retain the EXIF data even after being sent to another phone (or elsewhere) via MMS, bluetooth, etc..

Good luck

 
Posted : 03/04/2007 3:15 am
(@rich2005)
Posts: 535
Honorable Member
 

Bear in mind that even if you can somehow prove that these photos are in a date/time filename format, that a) on most phones you can rename the photos anyway so the date cant be relied upon b) the date and time will come from the handset's clock not the network so only be as accurate as whatever the user had the clock set to at the time of the picture being taken.
I'm basing this on my experience of UK handsets, however i cant imagine it would work any differently elsewhere for this sort of thing. Therefore i dont see how you could rely on the filenames in any way for court purposes (it may be different elsewhere - but i think that'd get hammered over here if you tried to rely on it).

 
Posted : 03/04/2007 3:58 pm
(@olddawg)
Posts: 108
Estimable Member
 

Bear in mind that even if you can somehow prove that these photos are in a date/time filename format, that a) on most phones you can rename the photos anyway so the date cant be relied upon

Very good point. Even if the filename is in a date/time format, it could have been "saved as" some date/time other than the current date/time.

 
Posted : 04/04/2007 6:58 am
(@trewmte)
Posts: 1877
Noble Member
 

To assist mobile telephone and computers examiners I have written a short piece about a useful tool to create a database of file signatures for images etc.

http//trewmte.blogspot.com/2007/04/file-signatures-mobile-phone-computer.html

 
Posted : 04/04/2007 3:17 pm
Page 1 / 2
Share: