I used an ExifTool Version Number 10.10 to look at an image on an Iphone 5C. The exif data indicated a modify date but no creation date. Does anyone know why? And, what does the modify date tell me?
Your pictures EXIF data could been manipulated, since the creation date is a default entry from the time of taking the picture.
Maybe the picture was copied over and it wasn't taken with that device.
Take a dummy picture with a similar device and analyze that, then see the differences.
Thank you for your feedback. I have one follow-up question; When you say manipulated, are you referring to the phone's user manipulating something? Or, are you referring to a manipulation because of something in the operating system, like a total reset or malware?
I used an ExifTool Version Number 10.10 to look at an image on an Iphone 5C. The exif data indicated a modify date but no creation date. Does anyone know why? And, what does the modify date tell me?
It's impossible to say why with any degree of certitude, at least as far as I can see.
One possible scenario could be image is created by tool x, and creation date is assigned. However, it's not exactly according to spec – perhaps it uses some format that uses 12 hour clock and AM/PM suffixes. Tool y, used to modify the image, can't read the creation date, as it requires 100% correct data. When it saves the modified image, modification date is set OK, but as creation date was incorrect in some way, that field is left empty.
A good forensic analyst should be able to come up with a dozen possibilities.
And from those you may be able to answer your own question.
If you know what software was involved, and how they behave, you may be able to check those hypotheses. Otherwise …