What is EXIF data: EXIF explained, and what it can and cannot establish
EXIF data is the block of technical information a camera or smartphone writes into an image file at the moment of capture, covering the device model, exposure settings, an embedded timestamp and, where location services are switched on, GPS coordinates.
EXIF stands for exchangeable image file format. It appears written as EXIF, Exif and occasionally exif, and all three refer to the same thing.
Who defines EXIF and what does it record?
The specification is maintained by the Camera and Imaging Products Association and published as CIPA DC-008, developed jointly with JEITA, the Japan Electronics and Information Technology Industries Association. Version 3.0 arrived in May 2023 and added UTF-8 support for non-ASCII text; version 3.1 followed in January 2026. Because it is a published standard, any tool that reads images can read the same fields.
A typical smartphone photograph carries:
- Device identity. Make, model, lens, and sometimes the operating system version.
- Capture settings. Aperture, shutter speed, ISO, focal length, flash state, orientation.
- Timestamps. Usually several, including original capture time and digitised time, taken from the device clock.
- Location. Latitude, longitude and often altitude, in the GPS fields, when location access was granted. See geotagging.
- Software history. The name of the last program that wrote the file, which is often the most informative field of the lot.
Why absent EXIF data proves nothing
Start here, because this is where investigations go wrong. EXIF is stripped constantly by systems doing exactly what they are designed to do. Messaging apps and social platforms remove it from the copy the recipient downloads, for privacy and file size. Screenshots have none of the original's fields. Editing software rewrites or discards what it does not recognise. Print and scan removes it entirely.
The practical result is that most photographs reaching a claims inbox have little or no original EXIF, and the reason is almost always the transport rather than the sender. An empty EXIF block is a dead end, not a red flag.
Why present EXIF data proves only what the file claims
The opposite error is more dangerous. EXIF is plain data stored in the file header, and editing it requires no expertise: free tools rewrite any field, including the capture timestamp and the GPS coordinates, in seconds and leave no trace of the edit inside the file.
Beyond deliberate editing, the fields are wrong by accident all the time:
- Device clocks drift or get set wrong, and a phone restored from a backup can produce genuinely odd values.
- Time zones are recorded inconsistently, so a photograph can look hours away from where the account places it.
- Coordinates come from a positioning fix, which can be stale, indoors and imprecise, or borrowed from a cached network location.
Everything inside the block is a statement the file makes about itself. That is a different category of fact from something recorded by a system the sender never had access to.
EXIF data explained: a worked example
A claim involves a scratched wing photographed, according to the customer, on the morning of the incident. The submitted image carries EXIF showing that date and a plausible location, which reads as confirmation.
It confirms nothing on its own. The same file's software field names a photo editor as the last application to write it, which means every value in the block passed through software capable of changing all of them. The correct response is a question to the customer, not an accusation and not a payment. Signals are a reason to look.
How EXIF differs from provenance data
EXIF is written by the sender's device and travels inside the sender's file. Provenance data is written by the receiving organisation's systems and stays under its control. That is the whole distinction, and it decides which one survives a challenge.
A server-side receipt time, a hash recorded on arrival and an audit trail are all outside the sender's reach. EXIF never is. Use EXIF as corroboration when it agrees with a stronger record, and as a prompt for questions when it does not, but never build a decision on it. The wider mechanics are covered in provenance, evidence integrity and metadata, and the fabrication problem behind the caution is set out in AI-generated insurance fraud. No metadata field, present or absent, makes an image impossible to fake.