Exif Data - Introduction

Exchangeable Image File Format




Exif Data is a metadata that is generated and stored by your camera whenever you take a photo and this data is embedded within your images and includes information about GPS coordinates (location), that is why many websites are stripping the exif data from the uploaded images due to privacy concern. Apart from your GPS coordinates exif stored many sensitive information and some of them are Camera Model Name, Modify Date, Date/Time Original, Create Date, File Source, Camera Firmware Version, Owner Name, Image Type etc. and all this information is then processed by Exif/DCF reader of the website, if not stripped by the server.

This type of information is formatted according to the TIFF specification and may be found in JPG, TIFF, PNG, JP2, PGF, MIFF, HDP, PSP and XCF images, as well as many TIFF-based RAW images and even some AVI and MOV videos. The EXIF meta information is organized into different Image File Directories (IFD’s) within an image. Exif IFD is a set of tags for recording Exif-specific attribute information.


Markers



In a simple language Markers are used to provide the information in a bitstream of a file for processing. Markers are used to specify units, pixel density, thumbnail, application-specific information and identify file types. The marker starts from 0xFFE0 to 0xFFEF (hex value) which is known as "Application Marker" and is used by user application to process the data in bitstream. Old digital cameras used JFIF extension instead of JPEG extension for storing images. All the markers have their names like APP0, APP1 and so on. JFIF used APP0 (0xFFE0) marker for inserting digital camera configuration data.

EXIF also uses an application marker for inserting data but it uses APP1 (0xFFE1) marker to avoid a conflict with JFIF format. If the same markers are used then there is a chance of conflict because the image processing libraries will not be able to identify whether the image is JFIF or EXIF. Every EXIF file formats starts from this format - APP1 Marker - 0xFFE1.

Breaking Down Image - Markers


1. SOI Marker - As you can see that it starts from SOI Marker, so it is a JPEG image file.
2. APP1 Marker - The next marker is APP1, it means that the file is storing the exif data in APP1 Data area.
3. APP1 Data - Here "SSSS" defines the size of the APP1 Data area. The actual data starts after "SSSS" and the first part is a special data for identifying whether it is an EXIF data or not.
4. Other Marker - This are the other markers of the specific file (JPEG in this case).



Exif Data Structure



This is just a rough structure to make you understand about the "Exif Data Structure". EXIF uses TIFF format to store data however exif does not relate to TIFF as JFIF relates itself to JPEG.

Breaking TIFF Header


TIFF stands for Tagged Image File Format, that represents raster images which are meant for usage on variety of devices that follow this file format standar. TIFF file header has file header is of 8-bytes.

Byte 0-1 :

The byte order used within the file. Legal values are:"II"(4949.H)"MM" (4D4D.H). In the "II" format, byte order is always from the least significant byte to the most significant byte, for both 16-bit and 32-bit integers, this is called little-endian byte order. In the "MM" format, byte order is always from most significant to least significant, for both 16-bit and 32-bit integers, this is called big-endian byte order.

Bytes 2-3 :

An arbitrary but carefully chosen number (42) that further identifies the file as a TIFF file. The byte order depends on the value of Bytes 0-1.

Bytes 4-7 :

The offset (in bytes) of the first IFD. The directory may be at any location in the file after the header but must begin on a word boundary. In particular, an Image File Directory may follow the image data it describes. Readers must follow the pointers wherever they may lead. The term byte offset is always used in this document to refer to a location with respect to the beginning of the TIFF file. The first byte of the file has an offset of 0.


Image File Directory



An Image File Direcotry contains information about the image as well as pointers to the actual image data. It consists of a 2-byte count of the number of directory entries (i.e. the number of fields), followed by a sequence of 12-byte field entries, followed by a 4-byte offset of the next IFD (or 0 if none). There must be at least 1 IFD in a TIFF file and each IFD must have at least one entry.

Breaking IFD Entry

0-1 : The tag that identifies the field.
2-3 : The field type.
4-7 : Count of the indicated type.
8-11 : The Value Offset, the file offset (in bytes) of the Value for the field.The Value is expected to begin on a word boundary; the correspond-ing Value Offset will thus be an even number. This file offset maypoint anywhere in the file, even after the image data.

A TIFF field is a logical entity consisting of TIFF tag and its value. This logical concept is implemented as an IFD Entry. This terms TIFF field and IFD entry are interchangeable in most contexts.

According to Exif Standards, there are three private IFDs (Image File Directories) :
1. Exif IFD tags
2. GPS IFD tags
3. Interoperability IFD tags


To Be Continued...

Comments

Post a Comment

Popular posts from this blog

Exif's Image File Directory - Forensics Perspective (Part 1)

Image
Exif IFD Tags Exif data contains different exif tags and each exif tag has its own value (eg. time, data, GPS etc). Exif tags are used to encode additional information related to an image when the image is generated or captured by the digital cameras. NOTE : There are many exif tags in exif's image file directory but I will cover the most important once from which one can find evidences. Tags 1. ExposureTime Exposure time is measured in seconds (eg. 1/500 (0.002 sec)). The main purpose of an exposure time is to describe the brightness of an image or the amount of light a sensor receives. Evidence : You can find out whether the photograhp is taken in brightness or darkness. If the exposure time is around 10 to 30 seconds then you can consider it as a night time photography and if the exposure time is around 1100 to 1125 seconds you can consider it as a day time photography. NOTE : Exposure timings are not always between the above mentioned values, they can set as per the ...
Read more

Introduction - Part 1

Image
Digital Forensics is a branch of forensic science that uses scientific knowledge or methods to gather evidence and solve crimes. It has some scientifically proven methods to preserve, collect, validate, identify, analyze, interpret, document and present the digital evidence. The main aim of a digital forensic investigation is to find facts and recreate the truth of an event. Digital Forensics has three main categories : Acquisition Analysis Presentation 1. Acquisition : Acquisition means collecting the digital media to examine. It includes optical media, hard drives, storage cards from camera, mobile phones, embedded chips from devices etc. The collected evidence should be treated delicately and a duplicate should be made of the collected evidence to maintain the record. 2. Analysis : In this category a media is actually examined with appropriate analysis methods. It includes file content examination, file system analysis, statistical analysis etc. and finally the results a...
Read more