Tinta Tech

Digital evidence

How to prove when and where a photo was taken

By Tinta Tech8 min readLeer en español

The short answer

No single piece of data proves when and where a photo was taken: the date and GPS tags in its EXIF metadata can be edited, and many apps strip them. What holds up is the combination of the untouched original file, a hash with a third-party timestamp made soon after capture, several photos of the same scene, and visible context. A timestamp shows the file existed no later than a given date; it does not show that the scene is real or who took the picture.

  • EXIF metadata (date, device, GPS) is information the file declares about itself. It is a useful lead, but it is easy to edit and easy to lose.
  • The original file, exactly as the camera saved it, is worth more than any forwarded copy or screenshot.
  • A hash and timestamp made the same day shrink the window for arguing about when the photo existed down to hours.
  • A timestamp sets a latest-possible date for the file. It does not establish the exact capture moment, the location or the photographer.
  • Send photos as a file or document, not as an image, so they are not recompressed or stripped of metadata.

What does EXIF metadata say about a photo's date and location?

It says what the camera or phone wrote down when it saved the image. EXIF is a block of data stored inside the file itself, and three fields matter most for evidence:

  • Capture date and time. Taken from the device clock. In many photos it is stored as local time with no time zone attached.
  • Device. Camera or phone make and model, and sometimes the lens and exposure settings.
  • GPS location. Coordinates of the spot, but only if location access was turned on for the camera at that moment.

You can read these fields in the file properties on a computer, in the photo details on a phone, or with View and remove metadata, which reads them in your browser.

Why is photo metadata not enough as proof?

Because it is text inside the file, and anyone can change it. No special skill is needed: common software can rewrite the date or the coordinates, and the resulting file looks perfectly ordinary.

  • It can be edited. A modified EXIF date leaves no mark you would notice by looking at the picture.
  • It gets stripped. Many messaging and social apps recompress images and remove some or all metadata when you send or post them. The same happens when someone cleans it on purpose, as described in how to remove metadata from photos.
  • The clock can be wrong. A camera whose date was never set, or a phone with a manually changed time, records the wrong value without anyone trying to deceive.
  • GPS drifts. Indoors or with a poor signal the recorded position can be off, and with location turned off there is nothing recorded at all.

Treat metadata for what it is: a statement made by the file. It helps reconstruct events and spot inconsistencies, but once the other side challenges it, it does not stand on its own.

What makes a photo stronger as evidence?

Stacking independent elements that point to the same date and place. None of them settles the question alone; together they are hard to dispute.

  • The untouched original. The file that sits on the camera card or in the phone's gallery, with no cropping, filters or forwarding.
  • A hash and timestamp soon after capture. A third party records that this exact file already existed at that moment.
  • Several photos of the same scene. Wide shots and close-ups from different angles. Faking a consistent series is far harder than retouching one image.
  • Visible context. Something dated or locatable inside the frame: a receipt, a parking meter display, a street sign, a door number.
  • Backups. An automatic cloud backup or an email to yourself the same day adds another date record held by someone else.

What does a timestamp prove about a photo, and what does it not?

It proves the file existed, with exactly that content, no later than the time on the timestamp. A hash (SHA-256) is a code calculated from the file; change one pixel and the hash is different. A time-stamping authority signs that hash together with the date and time under the RFC 3161 standard. The full mechanism is in what a trusted timestamp is.

It says nothing about what happened earlier. Timestamp today a photo taken a year ago and the timestamp vouches for today. Hence the practical rule: do it the same day, ideally within minutes.

QuestionEXIF aloneOriginal with hash and timestamp
Was the file changed afterward?Cannot be toldYes, it can: the hash would no longer match
Did it exist on a given date?Only the file says soYes, no later than the timestamp
What was the exact capture moment?Whatever the device clock declaredNot established; the window narrows if stamped quickly
Where was it taken?Whatever GPS declared, if it was onNot established; the declared value is preserved unchanged
Is the scene real and not staged?NoNo
Who took the photo?NoNo

With Certify a photo this takes a couple of minutes. The hash is calculated and the EXIF data is read in your browser, so the photos are not uploaded, and the certificate includes a thumbnail of each image along with its metadata labeled as declared. A certificate does not guarantee legal value and does not replace a notary or an expert.

How do you document damage, an accident or a delivery with photos?

The logic is the same every time: plenty of photos, taken on the spot, with context, and locked the same day.

SituationWhat to photographWhen to lock it
Rental propertyEach room as a whole, then every defect up close; meters and keysOn move-in day and again on move-out day
Car accidentVehicle positions, license plates, damage, road signs and road surfaceBefore moving the vehicles if it is safe; timestamp that day
DeliveriesThe sealed package with its label, the unboxing and the contentsOn receipt or on handover
Defective productThe defect, the serial number, the packaging and the receiptAs soon as you notice it, before filing a complaint

If anyone is hurt or the scene is dangerous, safety and help come first. Photos come after.

How do you send a photo without losing its metadata?

Send it as a file, not as a picture. When you attach a photo the usual way in a messaging app, it is typically resized, recompressed and stripped of metadata. The copy the other person receives is no longer the same file, and its hash will not match the original.

  • In messaging apps, use the document or file attachment option and pick the photo from there.
  • By email, attach the file at actual or original size if the app asks.
  • For a batch, share a cloud storage folder or a .zip archive.
  • Never swap the original for a screenshot. A screenshot is a new image with a different date and none of the camera data.

The recipient can confirm nothing changed in transit by comparing the file's hash with the certificate on the verification page.

Checklist and common mistakes

  1. Check that your phone's date and time are set automatically.
  2. Take wide shots and close-ups, and include something that places the scene.
  3. Do not edit, crop or filter the originals. If you need to mark something, do it on a copy.
  4. Hash and timestamp the originals the same day.
  5. Keep two copies in different places, along with the certificate.
  6. Always share as a file and keep the original in your possession.

These are the mistakes that cost a photo most of its value:

  • Keeping only the copy that went through a messaging app and deleting the original.
  • Taking a single close-up with nothing that places it.
  • Timestamping weeks later and expecting it to cover the capture date.
  • Fixing the EXIF date by hand because the clock was off. Leave the value as it is and explain the difference.
  • Presenting the certificate as proof that the scene is true. What it establishes is the integrity and date of the file.

If the photos will be central to a claim or a lawsuit, talk to a lawyer. Rules of evidence vary by country, and admissibility and weight are decided by the court.

Frequently asked questions

Is the EXIF date of a photo good evidence?
It is a useful indication but weak once challenged, because it can be edited and depends on the device clock. It gains strength when it lines up with other things: the untouched original, a nearby timestamp, backups and context visible in the image.
Can you tell if a photo's date was changed?
Sometimes. An examination may find mismatched date fields or traces of the software that edited the file, but a careful edit can leave nothing. That is why it helps to lock the original with a hash and timestamp before any dispute starts.
Does a timestamp prove when a photo was taken?
Not exactly. It proves the file already existed at the time of the timestamp. If you do it minutes after taking the photo, the gap between capture and timestamp is those few minutes.
Do photos sent through messaging apps keep their metadata?
Generally not when sent as an image: the app recompresses them and usually removes data such as location. Sent as a document or file, they arrive unchanged.
Is a screenshot of the photo good enough?
It shows the content, but it is a different file. It carries the date of the screenshot, not of the photo, and none of the camera data. Always keep the original.
What if my photo has no GPS location?
Rely on context: wide shots that show the place, signs, street numbers, and other records from the same day such as receipts or messages. Do not add coordinates to the file by hand.

Sources

This article is general information, not legal advice. If you need to submit evidence in a lawsuit or official process, consult a lawyer in your country. Found a mistake? Write to hola@tintatech.com.

Keep reading