01Location
- JPEG APP1 segment (Exif identifier code + TIFF structure)
- IFD0 (0th IFD) → Exif IFD pointer (0x8769) and GPS Info IFD pointer (0x8825)
- IFD1 (1st IFD) → thumbnail
02Questions it answers
- When was the photograph taken, according to the camera clock?
- What was the camera's offset from UTC at the time?
- Where was the device according to the GPS tags, and what UTC time did the GPS fix carry?
- Which camera make, model, body serial number or software is recorded?
03Format and versions
| Format | TIFF-structured attribute data inside APP1, byte order 'II' (little-endian) or 'MM' (big-endian); APP1 including all elements must not exceed 64 KB. Date tags are 20-byte ASCII 'YYYY:MM:DD HH:MM:SS' (24-hour). |
|---|---|
| Applies to | OffsetTime, OffsetTimeOriginal and OffsetTimeDigitized were added in Exif 2.31 (2016); Exif 3.0 (2023) adds a UTF-8 type. Older files carry no offset tags. |
04Key fields
| Field | What it tells you |
|---|---|
| DateTimeOriginal (0x9003), DateTimeDigitized (0x9004) | When the original image data was generated, and when it was stored as digital data. |
| DateTime (0x0132, IFD0) | Date and time of image creation; Exif uses it as the date and time the file was changed. |
| OffsetTime (0x9010), OffsetTimeOriginal (0x9011), OffsetTimeDigitized (0x9012) | ASCII, count 7: time difference from UTC, including daylight saving, for DateTime, DateTimeOriginal and DateTimeDigitized. |
| SubSecTime, SubSecTimeOriginal (0x9291), SubSecTimeDigitized | Fractions of a second for the corresponding date tags. |
| GPSLatitudeRef/GPSLatitude (1/2), GPSLongitudeRef/GPSLongitude (3/4) | N/S and E/W references, each coordinate as three RATIONAL values: degrees, minutes, seconds. |
| Make (0x010F), Model (0x0110), Software (0x0131), BodySerialNumber (0xA431) | Equipment manufacturer, model, software or firmware, and camera body serial number. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| DateTimeOriginal / DateTimeDigitized / DateTime | ASCII 'YYYY:MM:DD HH:MM:SS', no zone | Unknown values are filled with blanks except the colons, or entirely with blanks. |
| OffsetTime* | ASCII, count 7 | Apply to the paired date tag to obtain UTC; absent in pre-2.31 writers. |
| GPSTimeStamp (0x0007) | 3 × RATIONAL (hour, minute, second), UTC | Time of the GPS fix in UTC, independent of the camera clock. |
| GPSDateStamp (0x001D) | ASCII 'YYYY:MM:DD', count 11, UTC | Date relative to UTC; combine with GPSTimeStamp. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Hash the image and extract all IFDs (IFD0, Exif, GPS, IFD1) with a parser that reports raw tag values.
- Convert DateTimeOriginal to UTC only when OffsetTimeOriginal is present; otherwise report local camera time.
- Compare GPSDateStamp/GPSTimeStamp (UTC) with DateTimeOriginal to estimate the camera's offset and clock error.
- Compare DateTime (IFD0) and Software with DateTimeOriginal to detect later editing, and compare the IFD1 thumbnail with the main image.
07Interpretation pitfalls
- Exif date tags carry no time zone; without OffsetTime* tags, the UTC instant is unknown.
- The camera clock may be wrong or set to another zone; GPS time is UTC and can disagree by hours.
- Editing or messaging applications may remove, rewrite or add tags; all values are writable.
- The APP1 64 KB limit constrains thumbnails and maker data; large metadata may be stored elsewhere.
09Sources
- CIPA DC-008-2016 / JEITA CP-3451D — Exif Version 2.31 (course-hosted copy) Camera & Imaging Products Association · checked 2026-10-14
- Exiv2 — Standard Exif tags Exiv2 project · checked 2026-10-14
- Exiv2 — src/tags_int.cpp (tag definitions) Exiv2 project (GitHub) · checked 2026-10-14
- ExifTool — lib/Image/ExifTool/Exif.pm Phil Harvey (GitHub) · checked 2026-10-14
- ExifTool — GPS tags Phil Harvey, exiftool.org · checked 2026-10-14
- CIPA DC-008-2023 — Exif Version 3.0 Camera & Imaging Products Association