Check Image: How to Verify Authenticity, Origin, and Integrity

Every digital image carries a hidden layer of data - EXIF, XMP, and IPTC metadata - that records how, when, and where the file was created. But metadata can also be the first thing removed or fabricated when an image is manipulated. Knowing how to check image integrity is essential for journalists protecting source authenticity, e-commerce sellers verifying product photos, and anyone evaluating whether an image can be trusted.

Quick answer : Systematically verify an image's authenticity by cross-checking EXIF timestamps, GPS alignment, hash verification, and source provenance - any significant mismatch suggests the image has been altered or re-encoded.

The 4-Point Authenticity Check

1. Timestamp Consistency - The Date-Time Story

Every photo stores capture timestamps in EXIF DateTimeOriginal (0x9003). This is the camera's recorded date and time, set when the shutter fired. But DateTimeOriginal can be fabricated or altered by image editing software, batch processing tools that rewrite dates, messaging apps (WhatsApp, Telegram, Messenger) that re-encode photos and reset EXIF dates, and cloud sync services that may modify metadata during upload.

Quick check: Use an EXIF viewer to read DateTimeOriginal, CreateDate, and ModifyDate. All three should align within minutes of each other if the file has not been re-encoded. A ModifyDate that is seconds after DateTimeOriginal strongly suggests the file was re-saved or re-encoded (common during social media upload).

Cross-check with GPSDateStamp (UTC) when GPS was enabled. The GPS timestamp should match DateTimeOriginal within the time zone offset. A large mismatch suggests the clock was wrong on the device or the GPS data was altered.

2. GPS and Location Integrity - The Spatial Story

GPS metadata (GPSLatitudeRef, GPSLatitude, GPSLongitudeRef, GPSLongitude) records where the photo was captured. But GPS data can be fabricated by editing software that adds fake GPS coordinates, stripped entirely by remover tools leaving GPS fields empty, or mismatched with DateTimeOriginal if the location was spoofed.

Quick check: If GPSDateStamp exists, compare it with DateTimeOriginal. GPS is always in UTC; DateTimeOriginal is in the camera's local time. They should be consistent after applying the time zone offset. If GPS fields are present but DateTimeOriginal is missing, the GPS data may have been added independently - treat with suspicion.

For images without GPS, examine the file's creation/modification timestamps at the OS level (Windows: right-click to Properties to Details; macOS: Get Info). These filesystem dates should not contradict the EXIF dates without a known reason (e.g., file transfer, backup).

3. Hash Verification - The Fingerprint Check

A cryptographic hash (SHA-256, MD5) produces a unique fingerprint for exactly this file. If even one bit changes - through compression, resizing, or pixel alteration - the hash changes drastically. Hash verification is the most reliable way to confirm whether two files are identical or whether an image has been modified.

Quick check: Compute the SHA-256 hash of the original file and compare it against:

1. Hashes shared by the source (e.g., in a news wire, court filing, or product listing)
2. Hashes from image hosting platforms (some preserve original hashes; many recompress)
3. Hashes from backup copies or original camera files

Tools:

Windows: CertUtil -hashfile photo.jpg SHA256

macOS: shasum -a 256 photo.jpg

Linux: sha256sum photo.jpg

ExifTool: -HashTag

Online hash calculators

Important: Hashes only verify file identity - they do not verify content authenticity. An image can have a consistent hash while being entirely synthetic (AI-generated), or a modified version can have a different hash. Hashes are necessary but not sufficient for full authenticity verification.

4. Source Provenance - The Origin Story

Knowing where an image came from is as important as verifying its internal consistency. Source provenance tracks the file's journey from capture to current view.

Quick check:

1. Reverse image search (Google Images, TinEye, Yandex) to find earlier versions or the original capture
2. EXIF:Source fields if present (camera make/model, software used)
3. File creation date vs. claimed capture date - a large gap suggests the file was generated or imported later
4. Watermarks, logos, or studio markings that identify the original creator or agency

For journalistic or legal use, request the original unmodified file from the source. Forwarded images, screenshots, and social media downloads almost always lose the true capture metadata.

Limitation: Mobile App Dates

iOS and Android display a formatted capture date in the Photos app, not the raw EXIF tags. If a photo was edited, filtered, or re-exported, the app date may differ from DateTimeOriginal. Always ask for the original file when authenticity matters.

How to Verify If a Photo's Date Is Authentic

For journalism, insurance claims, or e-commerce compliance, a single DateTimeOriginal is not enough. Compare all four timestamps - DateTimeOriginal, CreateDate, GPSDateStamp, and FileModifyDate - and check that they align within expected tolerances:

1. DateTimeOriginal ≈ CreateDate (within minutes, if not identical)
2. GPSDateStamp consistent with DateTimeOriginal after time zone conversion
3. FileModifyDate: if it is seconds after DateTimeOriginal, the file was likely re-encoded on upload
4. FileCreationDate: if it predates DateTimeOriginal by days or weeks, the photo may have been taken later than the file suggests

Good to know: For product photos submitted to Amazon, eBay, or stock agencies, agencies increasingly verify EXIF consistency as part of their quality pipeline. Discrepancies can trigger listing suppression or fraud flags.

Quick Checklist

1. Upload original file to EXIF Viewer - read DateTimeOriginal first
2. Fall back to CreateDate, then FileCreateDate if DateTimeOriginal is empty
3. Cross-check GPSDateStamp when GPS was enabled
4. Remember: forwarded images lose the true capture date - always ask for the original
5. Strip dates before sharing private photos if privacy matters
6. Compute SHA-256 hash and compare against source if available
7. Reverse image search to trace the image's earliest known appearance
8. Request the original unmodified file for journalistic or legal use

FAQ

Can you tell when a photo was taken without EXIF data?

Partially. Without EXIF, you can only estimate from file system dates, cloud backup dates (Google Photos, iCloud), or social media upload timestamps - but none of these are as reliable as EXIF DateTimeOriginal. If the EXIF dates have been stripped, acknowledge the limitation clearly.

Why does my photo show today's date instead of when it was taken?

The photo was likely re-encoded by a messaging app (WhatsApp, Messenger, Telegram) or social platform (Instagram, Facebook, X), which resets EXIF dates to the forward date. Some image editors also write the current date as CreateDate when saving. Always request the original file.

Does a screenshot have a capture date?

Yes, but it is the time you took the screenshot, not when the original scene was photographed. Screenshots typically have no EXIF metadata at all - they are raster images without the camera metadata layer. If you need the original capture date, ask for the source photo.

How do I change or remove the date from a photo?

Use an EXIF editor (ExifTool, ExifCleaner, ExifInjector) to modify DateTimeOriginal, or an EXIF remover to strip all dates before sharing. Removing dates before sharing private photos is recommended if privacy matters. Do not fabricate a false capture date - this misrepresents the image's origin.

Is DateTimeOriginal in local time or UTC?

DateTimeOriginal is stored in the camera's local time (as set on the device). GPSDateStamp is always in UTC. When comparing the two, apply the camera's time zone offset. A mismatch after conversion suggests the clock was wrong on the device or the GPS data was altered.

EXTERNAL SOURCES

1. IPTC Code of Ethics for Photojournalism - standards for image integrity and alteration disclosure
2. C2PA Specification - content provenance and cryptographic metadata standards
3. Adobe XMP Specification - metadata framework for creative content
4. Google Search Central Documentation - image search and metadata best practices
5. FTC Guidelines on Endorsements and Sponsored Content - disclosure requirements for altered imagery