In our last post Someone Is Lying About EXIF Data; Is It Suneel or FBI Forensic Examiner Brian Booth?, we examined two men’s differing opinions on the difficulty of changing EXIF data on photographs.
FBI Senior Forensic Expert Brian Booth testified at the trial of Keith Raniere and EXIF data was almost the sole topic of his testimony.
Yes, EXIF data, the information a digital camera embeds inside the file of a digital photo, was the forensic evidence prosecution used to show that Keith Raniere took and possessed photos of Camila dating back to November 2005, when she was 15.
The proof was Booth’s testimony that 22 nude photos found on Raniere’s hard drive were reliably dated by EXIF data. The charges associated with this discovery were possession of child pornography and sexual exploitation of a child.
Over two days, June 12 and June 13, Booth testified, as he spoke of the EXIF data embedded in each photo, and of how EXIF data is reliable and very hard to change.
At one point, he said if you took a chance at changing the EXIF data dates, it could corrupt or ruin the file, and it would be even harder to tamper with the evidence by changing EXIF data dates because it would require an incredibly complicated job of altering evidence.
Suneel Chakravorty says EXIF data is easy to change.
Suneel Chakravorty, a computer tech consultant, and friend of Raniere’s, said that EXIF data is so easy to change that Booth, a forensic examiner for more than a dozen years, must have deliberately lied to the jury to suggest otherwise.
There is a meme on social media suggesting that Booth is akin to Pinocchio.
To try to prove the lie, Suneel made a video that shows him changing the EXIF data of a photo of apples, changing the camera that took the pictures from some unknown Canon camera to Keith Raniere’s camera, and changing the EXIF data date of the photo from November 30, 2016 to November 2, 2005, the same date that the EXIF data showed Camila’s pictures were taken.
So here we had FBI Senior Forensic Examiner Brian Booth, with all due solemnity, telling the jury under oath that EXIF data is hard to change. Then we have Suneel criticizing Booth for “lying” and demonstrating EXIF data can be changed on a photo in under one minute.
Before we examine the matter further by inviting others to weigh in, let us review what Booth actually said at the Raniere trial.
[I am adding clarifications in brackets and bold] and …
Whenever Booth makes an unequivocal statement about EXIF data being hard to change, I will put that in this larger size, bold font.
Booth was examined by AUSA Tanya Hajjar, who, at one point, asked him, “What is EXIF data?”
AUSA Tanya Hajjar elicited testimony from FBI Senior Forensic Examiner Brian Booth about EXIF data.
Booth said:
EXIF data is an exchangeable image file format. It’s a standard. It’s been around for quite some time. It was developed over in Japan back in the early 2000s to be able to add extra information to … JPEG files, which are graphic files… EXIF data holds … information…. mainly, it’s… the author, the photographer, and the dates and times and things like that.
EXIF Data contains notes from the camera.
Hajjar:
Is EXIF data considered metadata?
Booth:
Yes, it is.
Hajjar:
And how does EXIF data get captured in an image, in a JPEG, for example?
Booth:
…. The most common way is for the … camera or your [camera on your] phone, when you take the picture, the [camera] device will actually place that [EXIF data] into the JPEG file…
Hajjar:
Is there something unique about EXIF data?
Booth:
…. with EXIF data … when you move the JPEG [to another computer or device], the information [in the EXIF data embedded in the photo] stays within the JPEG. So camera models, things [other data normally recorded as EXIF data] of that nature, they go with it [the photo] wherever it goes.
Hajjar:
Can you explain that? What do you mean, like, “they go with it,” and they stay the same?
Booth:
… with EXIF data, once it’s embedded in a picture, it doesn’t matter how many times you move it around [from one place to another or from one device to another]. It [the EXIF data] stays [embedded] into that photo and
it’s very hard to remove. In fact, most commercial software will not touch EXIF data. It will allow you maybe to add data to it, but even in that sense, it’s very — it’s very able to be corrupted…
***
Hajjar:
Is there a particular reason why EXIF data is more difficult to alter?
Booth:
They purposely designed it that way…. It’s mainly to be able to store information. And they don’t want data to be moved around and changed, especially time and date information. Those things are very hard for the consumer to be able to modify, unless you wind up getting software that’s just developed to do that.
***
Hajjar [showing Booth a picture]:
… what’s the best evidence of when this photograph was taken?
Booth:
Well, the best evidence is the EXIF data because that gets put into the JPEG file and
it’s not easily modifiable
and it moves with the file the same way from device to device, no matter where you place it. It has nothing to do with the bearing of a file system at all or the dates and times associated with it. So, it’s on its own but are created at the same time that you take the picture.
***
[Reviewing EXIF data of Camila photos] Hajjar asked:
And, Examiner Booth, the EXIF data we just examined, they reflect two dates on which the images were taken?
Booth:
Yes.
Hajjar:
November 2nd, 2005, and November 24th, 2005?
Booth:
Correct.
HAJJAR:
No further questions, Your Honor.
Booth concluded his testimony by giving the EXIF data of dates of the Camila photos which, if accurate, indicate that she was 15 at the time the photos were taken.
***
Booth was cross-examined by one of Raniere’s attorneys, Paul DerOhannesian. He did not ask questions about EXIF data.
On redirect, Tanya Hajjar asked Booth more questions, honing in on EXIF data.
Hajjar:
Mr. DerOhannesian talked a lot about metadata previously with you [during the cross-examination.]
Booth:
Yes.
Hajjar:
He asked you questions about various types of metadata, is that right, on cross-examination?
Booth:
Yes.
Hajjar:
He didn’t once mention EXIF data; is that right?
Booth:
Correct.
Hajjar:
You spent the majority of your testimony on direct examination referring to EXIF data?
Booth:
Yes, I did.
Hajjar:
Why is that?
Booth:
There’s two types of metadata. There’s the stuff that you find on file systems which is called file system metadata, and then there is metadata that is embedded into images…. That’s EXIF data.
And EXIF data is actually put inside the file. Unlike the metadata that we’ve talked about previously which is attached outside of the file by the operating system [the computer]. The file system moves that along from place to place [changing from computer to computer] with it. So, at any point of giving that movement from place to place, there are times that things can get modified.
But when it comes to EXIF data, it used to be it would only be hard-coded in. You couldn’t modify it. And only during changes during the years did they open up that you could change the author’s name of a photo or even a Word document that you might have. You can always go in and change the author and put comments in and things like that and that’s metadata for a Word file.
But when it comes to photos, they still keep you from changing dates and times. It’s not easy to change those. You have to go through special processes to change those things…
It’s very rare that I’ve found someone has been changing metadata within a photo.
And that [EXIF data] time and date does not change from place to place. It stays embedded in the photo. So, there’s no outside constraint that’s changing it, from an OS, from an Apple computer to a Dell computer.
So these things [date and time of photos in EXIF data] stay consistent. Those are prime places I need to look because unless someone is sitting doing that hacking attempt to trying to do that [changing the EXIF data] which I didn’t see that with this [hard] drive [where the photos were found], I would have to assume all those dates [in the EXIF data of the Camila photos on the hard drive] are reflected [accurately] going all the way through [from the camera where the Camila photos were allegedly taken and the EXIF data recorded, to the camera card where the Camila photos were allegedly transferred and from there allegedly transferred to a Dell computer, which was never found, to the hard drive where the Camila photos were found].
Those [EXIF data times and dates] are embedded when you take the picture. I mean, you can go through your cell phone and see the times and dates and geo locations, too. If you try to modify those dates, you’ll find you can do it yourself very easily.
[This is a curious sentence. Either Booth is retracting everything he said before and after about EXIF data or it may be a mistake by the court stenographer. Booth might have said “can’t” modify dates “very easily.” He might possibly also meant that one can modify files very easily with other metadata which, unlike EXIF data, is not embedded in the photo. Booth continues].
In that sense, [EXIF data] it’s very important data here. And, make no mistake, that’s the data that I’m after as a forensic examiner. I can rely on that time and date [of the EXIF data]. I can’t rely on the date that someone else put on the files [meaning the file system dates and times].
Hajjar:
What’s most reliable in terms of all the metadata that was discussed thus far in your examination on direct and on cross?
Booth:
The EXIF data.
Hajjar:
Okay. Is that better, more reliable than the created date?
Booth:
It’s the most reliable.
Hajjar:
Is it better than — more reliable than the modified date?
Booth:
Yes.
Hajjar:
Is it more reliable than the access date?
Booth:
Yes.
Hajjar:
Is it more reliable than the thumb DB metadata?
Booth:
Yes.
Hajjar:
Is it more reliable than metadata that might have been imposed based on an OS or operating system?
Booth:
Oh, definitely.
Hajjar:
Every single type of metadata that was discussed on cross-examination of — and EXIF data, if you were to determine which of those was the most reliable which, would it be?
Booth:
The serial number of the camera and the time and the date.
Hajjar:
On the EXIF data?
Booth:
Yes.
Hajjar:
Now, all of the images in that red binder, all of the images [the 22 Camila photos] … do they have corresponding EXIF data?
Booth:
Corresponding?
Hajjar:
Like, for each of the image files that we looked at that were in the red binder?
Booth:
We had EXIF data.
Hajjar:
They had EXIF data?
Booth:
Yes.
Hajjar:
For each of those did they correspond to November 2nd 2005 or November 24th 2005?
Booth:
Yes, they did.
Hajjar:
Consistently?
Booth:
Consistently.
***
Hajjar:
Is there any other information that you found significant with respect to the date that was — the EXIF data date?
Booth:
Well, the fact that there’s so many dates that are in the EXIF data. Say I did have a modification software, I would have to change quite a bit of dates [to manually change the dates of the photo’s EXIF data]. I mean, I would have to go through, you know, a bunch of evidence, number one. But then I have to change — in EXIF data there are dates all up and down that including zero numbers, models of cameras, things of that nature. So there’s quite a bit of data to go through [in order to change the date and time of a photo] and when you modify a date and time, an EXIF date and time in a JPEG, you take the chance of modifying it to where it destroys the JPEG and that’s why Adobe likes to make a copy when they wind up changing EXIF data in the file because they don’t want to take the risk of actually ruining the JPEG file. So this is one of the reasons why a lot of software don’t go in and do a lot of changes to the EXIF data. Even if you wanted to just change the author, you’re taking a chance that you can change the data.
[After Booth explained how difficult it would be for him to alter the date and time of the EXIF data, which would, he said, require changing other data and risking ruining or corrupting the photos, Raniere’s attorney, DerOhanessian, asked him about altering EXIF data and Booth admitted it could be altered.
One of Keith Raniere’s defense attorneys, Paul DerOhannsian, cross-examined FBI Senior Forensic Examiner Brian Booth
DerOhanessian:
You agree that any metadata, whether it’s EXIF data or other data can be changed and altered; correct?
Booth:
Yes, EXIF data can be altered.
DerOhanessian:
And there’s a variety of different ways that that can happen; correct?
Booth:
Yes, it can.
DerOhanessian:
Companies can remove — if you send a photo to Facebook, do they take off that data?
Booth:
Yes, they actually strip off the data.
DerOhanessian:
So Facebook, Twitter that’s what they do?
Booth:
Yes, they do.
DerOhanessian:
And then they use that information for their commercial purposes?
Booth:
I wouldn’t know.
DerOhanessian:
That’s another way. There’s commercial processes that do that?
Booth:
I would gather.
***
That is as far as DerOhannessian went. He elicited from Booth that EXIF data can be altered, but he did not ask whether it was easy to alter. He got an admission that Facebook, etc. could remove EXIF data but did not ask if Booth himself had the ability to remove or change the EXIF data or if there were free software programs that could alter EXIF data.
Suneel claims there are many tools that make it easy for the layperson to change EXIF Data if they want to do so.
In our next post, we will examine more carefully some of the statements Booth made and get the opinions of experts.
It is clear, the prosecution wanted the jury to believe Booth that it was extremely difficult and complicated to alter EXIF data and that because Booth said so, the dates of the Camila photos are reliable.
It may very well be true that Keith Raniere took photos of Camila when she was 15. In fact, I think it is likely.
And it may be true that those photos in the red binder were pictures Raniere took of Camila when she was 15.
It may be true that these pictures were found on the hard drive, just like the FBI said they were.
But is it true that EXIF data is anywhere near as hard to change as Booth said?
Or was this clearly a lie and at times lies by omission to make the jury believe that the dates were rock solid, when maybe, just maybe they were not and he knew it?
There must have been a reason they went to so much trouble to sell the jury on the reliability of the dates of EXIF data.
Stay tuned…
