Digital evidence
How to prove when and where a photo was taken
By Tinta Tech8 min readLeer en español
The short answer
No single piece of data proves when and where a photo was taken: the date and GPS tags in its EXIF metadata can be edited, and many apps strip them. What holds up is the combination of the untouched original file, a hash with a third-party timestamp made soon after capture, several photos of the same scene, and visible context. A timestamp shows the file existed no later than a given date; it does not show that the scene is real or who took the picture.
- EXIF metadata (date, device, GPS) is information the file declares about itself. It is a useful lead, but it is easy to edit and easy to lose.
- The original file, exactly as the camera saved it, is worth more than any forwarded copy or screenshot.
- A hash and timestamp made the same day shrink the window for arguing about when the photo existed down to hours.
- A timestamp sets a latest-possible date for the file. It does not establish the exact capture moment, the location or the photographer.
- Send photos as a file or document, not as an image, so they are not recompressed or stripped of metadata.
What does EXIF metadata say about a photo's date and location?
It says what the camera or phone wrote down when it saved the image. EXIF is a block of data stored inside the file itself, and three fields matter most for evidence:
- Capture date and time. Taken from the device clock. In many photos it is stored as local time with no time zone attached.
- Device. Camera or phone make and model, and sometimes the lens and exposure settings.
- GPS location. Coordinates of the spot, but only if location access was turned on for the camera at that moment.
You can read these fields in the file properties on a computer, in the photo details on a phone, or with View and remove metadata, which reads them in your browser.
Why is photo metadata not enough as proof?
Because it is text inside the file, and anyone can change it. No special skill is needed: common software can rewrite the date or the coordinates, and the resulting file looks perfectly ordinary.
- It can be edited. A modified EXIF date leaves no mark you would notice by looking at the picture.
- It gets stripped. Many messaging and social apps recompress images and remove some or all metadata when you send or post them. The same happens when someone cleans it on purpose, as described in how to remove metadata from photos.
- The clock can be wrong. A camera whose date was never set, or a phone with a manually changed time, records the wrong value without anyone trying to deceive.
- GPS drifts. Indoors or with a poor signal the recorded position can be off, and with location turned off there is nothing recorded at all.
Treat metadata for what it is: a statement made by the file. It helps reconstruct events and spot inconsistencies, but once the other side challenges it, it does not stand on its own.
What makes a photo stronger as evidence?
Stacking independent elements that point to the same date and place. None of them settles the question alone; together they are hard to dispute.
- The untouched original. The file that sits on the camera card or in the phone's gallery, with no cropping, filters or forwarding.
- A hash and timestamp soon after capture. A third party records that this exact file already existed at that moment.
- Several photos of the same scene. Wide shots and close-ups from different angles. Faking a consistent series is far harder than retouching one image.
- Visible context. Something dated or locatable inside the frame: a receipt, a parking meter display, a street sign, a door number.
- Backups. An automatic cloud backup or an email to yourself the same day adds another date record held by someone else.
What does a timestamp prove about a photo, and what does it not?
It proves the file existed, with exactly that content, no later than the time on the timestamp. A hash (SHA-256) is a code calculated from the file; change one pixel and the hash is different. A time-stamping authority signs that hash together with the date and time under the RFC 3161 standard. The full mechanism is in what a trusted timestamp is.
It says nothing about what happened earlier. Timestamp today a photo taken a year ago and the timestamp vouches for today. Hence the practical rule: do it the same day, ideally within minutes.
| Question | EXIF alone | Original with hash and timestamp |
|---|---|---|
| Was the file changed afterward? | Cannot be told | Yes, it can: the hash would no longer match |
| Did it exist on a given date? | Only the file says so | Yes, no later than the timestamp |
| What was the exact capture moment? | Whatever the device clock declared | Not established; the window narrows if stamped quickly |
| Where was it taken? | Whatever GPS declared, if it was on | Not established; the declared value is preserved unchanged |
| Is the scene real and not staged? | No | No |
| Who took the photo? | No | No |
With Certify a photo this takes a couple of minutes. The hash is calculated and the EXIF data is read in your browser, so the photos are not uploaded, and the certificate includes a thumbnail of each image along with its metadata labeled as declared. A certificate does not guarantee legal value and does not replace a notary or an expert.
How do you document damage, an accident or a delivery with photos?
The logic is the same every time: plenty of photos, taken on the spot, with context, and locked the same day.
| Situation | What to photograph | When to lock it |
|---|---|---|
| Rental property | Each room as a whole, then every defect up close; meters and keys | On move-in day and again on move-out day |
| Car accident | Vehicle positions, license plates, damage, road signs and road surface | Before moving the vehicles if it is safe; timestamp that day |
| Deliveries | The sealed package with its label, the unboxing and the contents | On receipt or on handover |
| Defective product | The defect, the serial number, the packaging and the receipt | As soon as you notice it, before filing a complaint |
If anyone is hurt or the scene is dangerous, safety and help come first. Photos come after.
How do you send a photo without losing its metadata?
Send it as a file, not as a picture. When you attach a photo the usual way in a messaging app, it is typically resized, recompressed and stripped of metadata. The copy the other person receives is no longer the same file, and its hash will not match the original.
- In messaging apps, use the document or file attachment option and pick the photo from there.
- By email, attach the file at actual or original size if the app asks.
- For a batch, share a cloud storage folder or a .zip archive.
- Never swap the original for a screenshot. A screenshot is a new image with a different date and none of the camera data.
The recipient can confirm nothing changed in transit by comparing the file's hash with the certificate on the verification page.
Checklist and common mistakes
- Check that your phone's date and time are set automatically.
- Take wide shots and close-ups, and include something that places the scene.
- Do not edit, crop or filter the originals. If you need to mark something, do it on a copy.
- Hash and timestamp the originals the same day.
- Keep two copies in different places, along with the certificate.
- Always share as a file and keep the original in your possession.
These are the mistakes that cost a photo most of its value:
- Keeping only the copy that went through a messaging app and deleting the original.
- Taking a single close-up with nothing that places it.
- Timestamping weeks later and expecting it to cover the capture date.
- Fixing the EXIF date by hand because the clock was off. Leave the value as it is and explain the difference.
- Presenting the certificate as proof that the scene is true. What it establishes is the integrity and date of the file.
If the photos will be central to a claim or a lawsuit, talk to a lawyer. Rules of evidence vary by country, and admissibility and weight are decided by the court.
Frequently asked questions
- Is the EXIF date of a photo good evidence?
- It is a useful indication but weak once challenged, because it can be edited and depends on the device clock. It gains strength when it lines up with other things: the untouched original, a nearby timestamp, backups and context visible in the image.
- Can you tell if a photo's date was changed?
- Sometimes. An examination may find mismatched date fields or traces of the software that edited the file, but a careful edit can leave nothing. That is why it helps to lock the original with a hash and timestamp before any dispute starts.
- Does a timestamp prove when a photo was taken?
- Not exactly. It proves the file already existed at the time of the timestamp. If you do it minutes after taking the photo, the gap between capture and timestamp is those few minutes.
- Do photos sent through messaging apps keep their metadata?
- Generally not when sent as an image: the app recompresses them and usually removes data such as location. Sent as a document or file, they arrive unchanged.
- Is a screenshot of the photo good enough?
- It shows the content, but it is a different file. It carries the date of the screenshot, not of the photo, and none of the camera data. Always keep the original.
- What if my photo has no GPS location?
- Rely on context: wide shots that show the place, signs, street numbers, and other records from the same day such as receipts or messages. Do not add coordinates to the file by hand.
Sources
This article is general information, not legal advice. If you need to submit evidence in a lawsuit or official process, consult a lawyer in your country. Found a mistake? Write to hola@tintatech.com.
Keep reading
Digital evidence
How to capture a web page as evidence before it changes
Save the full-page image, the HTML, the response headers, the exact URL and the time, then lock each file with a hash and a trusted timestamp.
7 min · October 13, 2026
Digital evidence
How to preserve WhatsApp messages as evidence
Export the full chat from the app, keep the phone with nothing deleted, and lock the exported file with a hash and a trusted timestamp. Step by step.
7 min · October 13, 2026