Can EXIF data be restored after deletion (just like ordinary data) and what tool do you think is the best to delete EXIF data?
There are lots of ways to remove the EXIF data.
For example,
In Photoshop, simply go to File -> Save for Web & Devices and make sure that "Metadata" is set to "None".
Once it is gone it can't be recovered (unless the original file is found elsewhere on the hard disk).
Good afternoon friends,.
I would need to make a forence image of a hp thin client t510 16gb, as it is known it contains flash memory and not a hard disk.
What would be the correct way to extract the information?
Yes and no.
It depends on the OS, file system, and the actual file structure where the EXIF is "deleted".
For example, if the file system is a database file system type, some of those chucks of data which were modified are marked free, but not deleted. If the file system is a linear or streaming type (like tape or flash) the material can be in "historical" or previous segments of the storage. Those are potentially recoverable.
An other example is where the editing tool rewrites a jpeg APP1 block improperly. Since there can be multiple APP1, some tools will prepend the new APP1, but not remove the old one.
Agreed. I have been able to view EXIF data of deleted image files as long as there still fully intact. If one block of the file is overwritten, there is no telling how the Metadata will be displayed.
I used Netclean Analyze, IrfanView and Photoshop to view for metadata.