Photograph Analysis

Have a look at the metadata, there can be up to three timestamps included there which can show you when the photo was created and what program was used to edit it last.

Sorry for being dense! But how do I do that?

I'd suggest learning manually. Find out the specification of the picture. If it's a digital camera image it may have EXIF metadata. If so read

http//www.exif.org/specifications.html

Check the various timestamps in the metadata as well as the file system time stamps. Compare, test and analyse.

You need to understand what the tool is doing before you can draw conclusions.

Aquaman,

Check out the OPanda program (Google it). Works for me.

Good luck,

Cowboy

Thanks for the info. I read it through, but I have to say, I didn't understand all of it. I am a beginner to all of this and trying to find me feet on a steep learning curve.
I have compared the time stamps on the photo with the metadata, which match, but do you know which part of JPEGsnoop will tell me if the timestamp on the image itself has been put on by the camera or added through software after the image has been put onto a computer. Is there a specific code or line in snoop that I should be looking for?

Hope this works, but the snoop report is below……

Start Offset 0x00000000
Marker SOI (xFFD8)
OFFSET 0x00000000

Marker APP0 (xFFE0)
OFFSET 0x00000002
length = 16
identifier = [JFIF]
version = [1.1]
density = 480 x 480 DPI (dots per inch)
thumbnail = 0 x 0

Marker APP1 (xFFE1)
OFFSET 0x00000014
length = 7826
Identifier = [Exif]
Identifier TIFF = 0x[4D4D002A 00000008]
Endian = Motorola (big)
TAG Mark x002A = 0x002A

EXIF IFD0 @ Absolute 0x00000026
Dir Length = 0x000C
[Make ] = "CAMERA"
[Model ] = "DC2102"
[Orientation ] = Row 0 top, Col 0 left
[XResolution ] = 480/1
[YResolution ] = 480/1
[ResolutionUnit ] = Inch
[Software ] = "Microsoft Windows Photo Gallery 6.0.6001.18000"
[DateTime ] = "20081220 162626"
[YCbCrPositioning ] = Co-sited
[ExifOffset ] = @ 0x0938
[XPKeywords ] = "2008"
Offset to Next IFD = 0x000013F2

EXIF IFD1 @ Absolute 0x00001410
Dir Length = 0x0006
[Compression ] = JPEG
[XResolution ] = 96/1
[YResolution ] = 96/1
[ResolutionUnit ] = Inch
[JpegIFOffset ] = @ +0x1450 = @ 0x146E
[JpegIFByteCount ] = 2617
Offset to Next IFD = 0x00000000

EXIF SubIFD @ Absolute 0x00000956
Dir Length = 0x0028
[ExposureTime ] = 1583/1000000 s
[FNumber ] = F2.8
[ExposureProgram ] = Normal program
[ISOSpeedRatings ] = 64
[ExifVersion ] = 02.21
[DateTimeOriginal ] = "20080429 170832"
[DateTimeDigitized ] = "20080429 170832"
[ComponentsConfiguration ] = [Y Cb Cr .]
[ShutterSpeedValue ] = 9303/1000
[ApertureValue ] = 297/100
[ExposureBiasValue ] = 0.70 eV
[MaxApertureValue ] = 297/100
[MeteringMode ] = Pattern
[LightSource ] = unknown
[Flash ] = Flash did not fire
[FocalLength ] = 6 mm
[SubSecTimeOriginal ] = "00"
[SubSecTimeDigitized ] = "00"
[FlashPixVersion ] = 01.00
[ExifImageWidth ] = 2460
[ExifImageHeight ] = 3280
[ExifInteroperabilityOffset ] = @ 0x138A
[ExposureIndex ] = 64/1
[SensingMethod ] = One-chip color area sensor
[FileSource ] = DSC
[SceneType ] = A directly photographed image
[CustomRendered ] = Normal process
[ExposureMode ] = Auto exposure
[WhiteBalance ] = Auto white balance
[DigitalZoomRatio ] = 0/10
[FocalLengthIn35mmFilm ] = 34
[SceneCaptureType ] = Standard
[GainControl ] = 0
[Contrast ] = 0
[Saturation ] = 0
[Sharpness ] = 0
[SubjectDistanceRange ] = 0
[ImageUniqueID ] = "17A4D73421033852EEAA28396493FC31"

EXIF InteropIFD @ Absolute 0x000013A8
Dir Length = 0x0003
[InteroperabilityVersion ] = 01.00
[RelatedImageWidth ] = 2460
[RelatedImageLength ] = 3280

Marker APP1 (xFFE1)
OFFSET 0x00001EA8
length = 3062
Identifier = [http//ns.adobe.com/xap/1.0/]
XMP =
|<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?>
|<xxmpmeta xmlnsx="adobensmeta/" xxmptk="XMP Core 5.1.2">
| <rdfRDF xmlnsrdf="http//www.w3.org/1999/02/22-rdf-syntax-ns#"&gt;
| <rdfDescription rdfabout="" xmlnsdc="http//purl.org/dc/elements/1.1/" xmlnsMicrosoftPhoto="http//ns.microsoft.com/photo/1.0" xmlnsxmpMM="http//ns.adobe.com/xap/1.0/mm/" MicrosoftPhotoDateAcquired="2008-12-20T181718" xmpMMInstanceID="uuidfaf5bdd5-ba3d-11da-ad31-d33d75182f1b">
| <dcsubject>
| <rdfBag>
| <rdfli>2008</rdfli>
| </rdfBag>
| </dcsubject>
| <MicrosoftPhotoLastKeywordXMP>
| <rdfBag>
| <rdfli>2008</rdfli>
| </rdfBag>
| </MicrosoftPhotoLastKeywordXMP>
| </rdfDescription>
| <rdfDescription xmlnsxmp="http//ns.adobe.com/xap/1.0/"><xmpCreatorTool>Microsoft Windows Photo Gallery 6.0.6001.18000</xmpCreatorTool><xmpCreateDate>2008-04-29T170832</xmpCreateDate></rdfDescription></rdfRDF>
|</xxmpmeta>

Marker APP2 (xFFE2)
OFFSET 0x00002AA0
length = 3160
Identifier = [ICC_PROFILE]
ICC Profile
Marker Number = 1 of 1
Profile Size 3144 bytes
Preferred CMM Type 'Lino' (0x4C696E6F)
Profile Version 0.2.1.0 (0x02100000)
Profile Device/Class Display Device profile ('mntr' (0x6D6E7472))
Data Colour Space rgbData ('RGB ' (0x52474220))
Profile connection space (PCS) 'XYZ ' (0x58595A20)
Profile creation date 1998-02-09 064900
Profile file signature 'acsp' (0x61637370)
Primary platform Microsoft Corporation ('MSFT' (0x4D534654))
Profile flags 0x00000000
Profile flags > Profile not embedded
Profile flags > Profile can't be used independently of embedded
Device Manufacturer 'IEC ' (0x49454320)
Device Model 'sRGB' (0x73524742)
Device attributes 0x00000000_00000000
Device attributes > Reflective
Device attributes > Glossy
Device attributes > Media polarity = negative
Device attributes > Black & white media
Rendering intent Perceptual
Profile creator 'HP ' (0x48502020)
Profile ID 0x00000000_00000000_00000000

Marker DQT (xFFDB)
Define a Quantization Table.
OFFSET 0x000036FA
Table length = 67
—-
Precision=8 bits
Destination ID=0 (Luminance)
DQT, Row #0 4 2 2 4 5 9 11 13
DQT, Row #1 3 3 3 4 6 13 13 12
DQT, Row #2 3 3 4 5 9 13 15 12
DQT, Row #3 3 4 5 6 11 19 18 14
DQT, Row #4 4 5 8 12 15 24 23 17
DQT, Row #5 5 8 12 14 18 23 25 20
DQT, Row #6 11 14 17 19 23 27 26 22
DQT, Row #7 16 20 21 22 25 22 23 22
Approx quality factor = 88.93 (scaling=22.14 variance=1.28)

Marker DQT (xFFDB)
Define a Quantization Table.
OFFSET 0x0000373F
Table length = 67
—-
Precision=8 bits
Destination ID=1 (Chrominance)
DQT, Row #0 4 4 5 10 22 22 22 22
DQT, Row #1 4 5 6 15 22 22 22 22
DQT, Row #2 5 6 12 22 22 22 22 22
DQT, Row #3 10 15 22 22 22 22 22 22
DQT, Row #4 22 22 22 22 22 22 22 22
DQT, Row #5 22 22 22 22 22 22 22 22
DQT, Row #6 22 22 22 22 22 22 22 22
DQT, Row #7 22 22 22 22 22 22 22 22
Approx quality factor = 88.89 (scaling=22.22 variance=0.19)

Marker SOF0 (Baseline DCT) (xFFC0)
OFFSET 0x00003784
Frame header length = 17
Precision = 8
Number of Lines = 3280
Samples per Line = 2460
Image Size = 2460 x 3280
Raw Image Orientation = Portrait
Number of Img components = 3
Component[1] ID=0x01, Samp Fac=0x22 (Subsamp 1 x 1), Quant Tbl Sel=0x00 (Lum Y)
Component[2] ID=0x02, Samp Fac=0x11 (Subsamp 2 x 2), Quant Tbl Sel=0x01 (Chrom Cb)
Component[3] ID=0x03, Samp Fac=0x11 (Subsamp 2 x 2), Quant Tbl Sel=0x01 (Chrom Cr)

Marker DHT (Define Huffman Table) (xFFC4)
OFFSET 0x00003797
Huffman table length = 31
—-
Destination ID = 0
Class = 0 (DC / Lossless Table)
Codes of length 01 bits (000 total)
Codes of length 02 bits (001 total) 00
Codes of length 03 bits (005 total) 01 02 03 04 05
Codes of length 04 bits (001 total) 06
Codes of length 05 bits (001 total) 07
Codes of length 06 bits (001 total) 08
Codes of length 07 bits (001 total) 09
Codes of length 08 bits (001 total) 0A
Codes of length 09 bits (001 total) 0B
Codes of length 10 bits (000 total)
Codes of length 11 bits (000 total)
Codes of length 12 bits (000 total)
Codes of length 13 bits (000 total)
Codes of length 14 bits (000 total)
Codes of length 15 bits (000 total)
Codes of length 16 bits (000 total)
Total number of codes 012

Marker DHT (Define Huffman Table) (xFFC4)
OFFSET 0x000037B8
Huffman table length = 181
—-
Destination ID = 0
Class = 1 (AC Table)
Codes of length 01 bits (000 total)
Codes of length 02 bits (002 total) 01 02
Codes of length 03 bits (001 total) 03
Codes of length 04 bits (003 total) 00 04 11
Codes of length 05 bits (003 total) 05 12 21
Codes of length 06 bits (002 total) 31 41
Codes of length 07 bits (004 total) 06 13 51 61
Codes of length 08 bits (003 total) 07 22 71
Codes of length 09 bits (005 total) 14 32 81 91 A1
Codes of length 10 bits (005 total) 08 23 42 B1 C1
Codes of length 11 bits (004 total) 15 52 D1 F0
Codes of length 12 bits (004 total) 24 33 62 72
Codes of length 13 bits (000 total)
Codes of length 14 bits (000 total)
Codes of length 15 bits (001 total) 82
Codes of length 16 bits (125 total) 09 0A 16 17 18 19 1A 25 26 27 28 29 2A 34 35 36
37 38 39 3A 43 44 45 46 47 48 49 4A 53 54 55 56
57 58 59 5A 63 64 65 66 67 68 69 6A 73 74 75 76
77 78 79 7A 83 84 85 86 87 88 89 8A 92 93 94 95
96 97 98 99 9A A2 A3 A4 A5 A6 A7 A8 A9 AA B2 B3
B4 B5 B6 B7 B8 B9 BA C2 C3 C4 C5 C6 C7 C8 C9 CA
D2 D3 D4 D5 D6 D7 D8 D9 DA E1 E2 E3 E4 E5 E6 E7
E8 E9 EA F1 F2 F3 F4 F5 F6 F7 F8 F9 FA
Total number of codes 162

Marker DHT (Define Huffman Table) (xFFC4)
OFFSET 0x0000386F
Huffman table length = 31
—-
Destination ID = 1
Class = 0 (DC / Lossless Table)
Codes of length 01 bits (000 total)
Codes of length 02 bits (003 total) 00 01 02
Codes of length 03 bits (001 total) 03
Codes of length 04 bits (001 total) 04
Codes of length 05 bits (001 total) 05
Codes of length 06 bits (001 total) 06
Codes of length 07 bits (001 total) 07
Codes of length 08 bits (001 total) 08
Codes of length 09 bits (001 total) 09
Codes of length 10 bits (001 total) 0A
Codes of length 11 bits (001 total) 0B
Codes of length 12 bits (000 total)
Codes of length 13 bits (000 total)
Codes of length 14 bits (000 total)
Codes of length 15 bits (000 total)
Codes of length 16 bits (000 total)
Total number of codes 012

Marker DHT (Define Huffman Table) (xFFC4)
OFFSET 0x00003890
Huffman table length = 181
—-
Destination ID = 1
Class = 1 (AC Table)
Codes of length 01 bits (000 total)
Codes of length 02 bits (002 total) 00 01
Codes of length 03 bits (001 total) 02
Codes of length 04 bits (002 total) 03 11
Codes of length 05 bits (004 total) 04 05 21 31
Codes of length 06 bits (004 total) 06 12 41 51
Codes of length 07 bits (003 total) 07 61 71
Codes of length 08 bits (004 total) 13 22 32 81
Codes of length 09 bits (007 total) 08 14 42 91 A1 B1 C1
Codes of length 10 bits (005 total) 09 23 33 52 F0
Codes of length 11 bits (004 total) 15 62 72 D1
Codes of length 12 bits (004 total) 0A 16 24 34
Codes of length 13 bits (000 total)
Codes of length 14 bits (001 total) E1
Codes of length 15 bits (002 total) 25 F1
Codes of length 16 bits (119 total) 17 18 19 1A 26 27 28 29 2A 35 36 37 38 39 3A 43
44 45 46 47 48 49 4A 53 54 55 56 57 58 59 5A 63
64 65 66 67 68 69 6A 73 74 75 76 77 78 79 7A 82
83 84 85 86 87 88 89 8A 92 93 94 95 96 97 98 99
9A A2 A3 A4 A5 A6 A7 A8 A9 AA B2 B3 B4 B5 B6 B7
B8 B9 BA C2 C3 C4 C5 C6 C7 C8 C9 CA D2 D3 D4 D5
D6 D7 D8 D9 DA E2 E3 E4 E5 E6 E7 E8 E9 EA F2 F3
F4 F5 F6 F7 F8 F9 FA
Total number of codes 162

Marker SOS (Start of Scan) (xFFDA)
OFFSET 0x00003947
Scan header length = 12
Number of img components = 3
Component[1] selector=0x01, table=0x00
Component[2] selector=0x02, table=0x11
Component[3] selector=0x03, table=0x11
Spectral selection = 0 .. 63
Successive approximation = 0x00

Decoding SCAN Data
OFFSET 0x00003955
Scan Decode Mode Full IDCT (AC + DC)

Scan Data encountered marker 0xFFD9 @ 0x0016C659.0

Compression stats
Compression Ratio 16.381
Bits per pixel 1.471

Huffman code histogram stats
Huffman Table (Dest ID 0, Class DC)
# codes of length 01 bits 0 ( 0%)
# codes of length 02 bits 7866 ( 6%)
# codes of length 03 bits 96176 ( 76%)
# codes of length 04 bits 12768 ( 10%)
# codes of length 05 bits 6627 ( 5%)
# codes of length 06 bits 2472 ( 2%)
# codes of length 07 bits 371 ( 0%)
# codes of length 08 bits 0 ( 0%)
# codes of length 09 bits 0 ( 0%)
# codes of length 10 bits 0 ( 0%)
# codes of length 11 bits 0 ( 0%)
# codes of length 12 bits 0 ( 0%)
# codes of length 13 bits 0 ( 0%)
# codes of length 14 bits 0 ( 0%)
# codes of length 15 bits 0 ( 0%)
# codes of length 16 bits 0 ( 0%)

Huffman Table (Dest ID 1, Class DC)
# codes of length 01 bits 0 ( 0%)
# codes of length 02 bits 41410 ( 66%)
# codes of length 03 bits 12443 ( 20%)
# codes of length 04 bits 6328 ( 10%)
# codes of length 05 bits 2320 ( 4%)
# codes of length 06 bits 562 ( 1%)
# codes of length 07 bits 76 ( 0%)
# codes of length 08 bits 1 ( 0%)
# codes of length 09 bits 0 ( 0%)
# codes of length 10 bits 0 ( 0%)
# codes of length 11 bits 0 ( 0%)
# codes of length 12 bits 0 ( 0%)
# codes of length 13 bits 0 ( 0%)
# codes of length 14 bits 0 ( 0%)
# codes of length 15 bits 0 ( 0%)
# codes of length 16 bits 0 ( 0%)

Huffman Table (Dest ID 0, Class AC)
# codes of length 01 bits 0 ( 0%)
# codes of length 02 bits 664065 ( 42%)
# codes of length 03 bits 194161 ( 12%)
# codes of length 04 bits 303538 ( 19%)
# codes of length 05 bits 201743 ( 13%)
# codes of length 06 bits 23505 ( 1%)
# codes of length 07 bits 52183 ( 3%)
# codes of length 08 bits 62293 ( 4%)
# codes of length 09 bits 35883 ( 2%)
# codes of length 10 bits 21202 ( 1%)
# codes of length 11 bits 11092 ( 1%)
# codes of length 12 bits 10736 ( 1%)
# codes of length 13 bits 0 ( 0%)
# codes of length 14 bits 0 ( 0%)
# codes of length 15 bits 2137 ( 0%)
# codes of length 16 bits 6374 ( 0%)

Huffman Table (Dest ID 1, Class AC)
# codes of length 01 bits 0 ( 0%)
# codes of length 02 bits 106724 ( 43%)
# codes of length 03 bits 63687 ( 25%)
# codes of length 04 bits 31702 ( 13%)
# codes of length 05 bits 18775 ( 8%)
# codes of length 06 bits 18471 ( 7%)
# codes of length 07 bits 628 ( 0%)
# codes of length 08 bits 8084 ( 3%)
# codes of length 09 bits 1296 ( 1%)
# codes of length 10 bits 347 ( 0%)
# codes of length 11 bits 151 ( 0%)
# codes of length 12 bits 10 ( 0%)
# codes of length 13 bits 0 ( 0%)
# codes of length 14 bits 12 ( 0%)
# codes of length 15 bits 0 ( 0%)
# codes of length 16 bits 26 ( 0%)

YCC clipping in DC
Y component [<0= 0] [>255= 0]
Cb component [<0= 0] [>255= 0]
Cr component [<0= 0] [>255= 0]

RGB clipping in DC
R component [<0= 0] [>255= 0]
G component [<0= 0] [>255= 0]
B component [<0= 0] [>255= 0]

Brightest Pixel Search
YCC=[ 1070, 7, 9] RGB=[255,254,255] @ MCU[ 1, 90]

Finished Decoding SCAN Data
Number of RESTART markers decoded 0
Next position in scan buffer Offset 0x0016C658.4

Marker EOI (End of Image) (xFFD9)
OFFSET 0x0016C659

Searching Compression Signatures

Signature 010F50672F14B4A88409AEC86E9DECE9
Signature (Rotated) 01C3B4FE62DF9A99F1CA8A5C17AC7711
File Offset 0 bytes
Chroma subsampling 2x2
EXIF Make/Model OK [CAMERA] [DC2102]
EXIF Makernotes NONE
EXIF Software OK [Microsoft Windows Photo Gallery 6.0.6001.18000]

Searching Compression Signatures (3327 built-in, 2 user(*) )

EXIF.Make / Software EXIF.Model Quality Subsamp Match?
————————- ———————————– —————- ————–
CAM[NIKON ] [E885 ] [FINE ] No
CAM[OLYMPUS OPTICAL CO.,LTD ] [C2000Z ] [ ] No
CAM[OLYMPUS OPTICAL CO.,LTD ] [C3040Z ] [ ] No
CAM[OLYMPUS OPTICAL CO.,LTD ] [C700UZ ] [ ] No
CAM[PENTAX ] [PENTAX Optio 550 ] [ ] No
CAM[SEIKO EPSON CORP. ] [PhotoPC 3000Z ] [ ] No
CAM[SONY ] [DSC-H7 ] [ ] No
CAM[SONY ] [DSC-H9 ] [ ] No
SW [IJG Library ] [089 ]
*CAM[CAMERA ] [DC2102 ] [ ] Yes
*CAM[CAMERA ] [DC2102 ] [ ] Yes

The following IJG-based editors also match this signature
SW [GIMP ] [089 ]
SW [IrfanView ] [089 ]
SW [idImager ] [089 ]
SW [FastStone Image Viewer ] [089 ]
SW [NeatImage ] [089 ]
SW [Paint.NET ] [089 ]
SW [Photomatix ] [089 ]
SW [XnView ] [089 ]

NOTE EXIF Software field recognized as from editor
Based on the analysis of compression characteristics and EXIF metadata

ASSESSMENT Class 1 - Image is processed/edited

[DateTimeOriginal ] = "20080429 170832"
[DateTimeDigitized ] = "20080429 170832"

This is the time that the image was taken according to the camera that took it.

Then here we see that an edit has been made. Could just be a resize or something.

[Software ] = "Microsoft Windows Photo Gallery 6.0.6001.18000"
[DateTime ] = "20081220 162626"

Thanks, that's all I could see too!