implbits

Check an image's metadata before you trust it

The Implbits editorsPublished Updated 5 min read

Tested onUbuntu 22.04, ExifTool 13.60, 2026-10-30

Flat geometric drawing of a photo beside a grid of field discs, two of them marked orange.
Metadata fields are claims to read, not proof to trust.
Short answer

To check image metadata, open the file's properties on Windows, the Inspector in Preview on a Mac, or run exiftool -a -u -g1 on any system. Look for the camera or app that wrote the file, the dates, and an IPTC digital source type such as trainedAlgorithmicMedia, the standard label for AI-generated images.

Image metadata is the text a camera, phone or app writes into a file alongside the pixels: the device, the settings, the dates, sometimes the location, and increasingly a label saying whether AI made the image. To check image metadata is to read those fields before you decide how much to trust a picture. It takes a minute on any system.

This guide is part of our ranked checks for images, documents and text. Metadata sits in the middle of that ranking: more useful than a guess, far weaker than a signed record. If the image might carry content credentials, check those first in a browser, because a valid credential outranks anything below.

Before you start: keep an untouched copy

Opening an image in an editor and saving it can rewrite or drop metadata. Copy the file first and inspect the copy. Note where the file came from, because a copy downloaded from a social site has usually been stripped already.

Read metadata on Windows

  1. Right-click the image in File Explorer and choose Properties.
  2. Open the Details tab.
  3. Read the fields listed there, such as the dimensions, the camera details and any dates the file records.

The Details tab is a quick first look, not a full inventory. Treat a field missing there as unknown, not absent: read the complete set, including any AI source label, with ExifTool below, and check content credentials in a C2PA viewer.

Read metadata on a Mac

  1. Open the image in Preview.
  2. Click the Inspector button in the toolbar.
  3. Use the General info and More info panes.

Apple's guide says the Inspector shows information such as file size, the author name and the image resolution, and that the More info pane shows information about an image in different formats and about where a photo was taken (Apple Preview User Guide). As on Windows, it is a summary. For everything, use ExifTool.

Read everything with ExifTool

ExifTool is a free, open-source program that reads and writes metadata in a very wide range of file formats, and runs on Windows, macOS and Linux. The ExifTool documentation gives this as the command to "print all meta information in an image, including duplicate and unknown tags, sorted by group":

LinuxTerminal
exiftool -a -u -g1 test.jpg

On our test image, a plain JPEG exported by ImageMagick, the output was short (excerpt, file system dates removed):

Output
---- ExifTool ----
ExifTool Version Number         : 13.60
---- File ----
File Type                       : JPEG
File Type Extension             : jpg
MIME Type                       : image/jpeg
Image Width                     : 640
Image Height                    : 480
Encoding Process                : Baseline DCT, Huffman coding
Bits Per Sample                 : 8
Color Components                : 3
Y Cb Cr Sub Sampling            : YCbCr4:2:0 (2 2)
---- JFIF ----
JFIF Version                    : 1.01
Resolution Unit                 : None
X Resolution                    : 1
Y Resolution                    : 1
---- Composite ----
Image Size                      : 640x480
Megapixels                      : 0.307

No camera, no software name, no dates beyond the file system's. That is what most re-exported images look like. A photo straight from a phone would add EXIF groups with the make, model, exposure, timestamps and often GPS.

The documentation notes that this command may not extract everything, for speed. To extract absolutely everything, it suggests adding -ee3 -api RequestAll=3.

What to look for

  • Software and device fields: Make, Model, Software, Creator Tool. Do they fit the story you were told?
  • Dates: Date/Time Original against Modify Date. A large gap means the file was edited later.
  • GPS fields: if present, do they match the claimed place?
  • A JUMBF group: ExifTool lists embedded C2PA data under JUMBF. If you see it, the file carries a content credential; read it with c2patool to validate it, since ExifTool reads the data but does not check the signature.
  • Digital Source Type: the AI label, below.

AI source labels (IPTC digital source type)

The IPTC, the standards body for news metadata, keeps a vocabulary of digital source types that say how an image came to exist. The one to look for on a suspect image is trainedAlgorithmicMedia, which IPTC names "Created using Generative AI" (IPTC Digital Source Type). Related values include compositeWithTrainedAlgorithmicMedia ("Edited using Generative AI") and digitalCapture ("Digital capture sampled from real life").

To read just that field, with its group name:

LinuxTerminal
exiftool -a -G1 -DigitalSourceType test.jpg

Our test image had no such field, so the command printed nothing. To show how a labelled file reads, we added the label ourselves:

LinuxTerminal
exiftool -XMP-iptcExt:DigitalSourceType="http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia" test.jpg
exiftool -a -G1 -DigitalSourceType test.jpg
Output
    1 image files updated
[XMP-iptcExt]   Digital Source Type             : http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia

Then we removed all metadata with the documented -all= option and read it again:

LinuxTerminal
exiftool -all= test.jpg
exiftool -a -G1 -DigitalSourceType test.jpg
Output
    1 image files updated

The second command printed nothing. The label was gone in one command, and nothing in the file shows it was ever there.

Why missing metadata proves little

That last test is the whole lesson. Writing a label took one command; removing it took another. So:

  • A label that is present is a useful lead, especially an AI source label written by a generator. It can also have been added by anyone.
  • A label that is missing means almost nothing. Editors, converters, screenshots and upload services all drop metadata routinely.
  • Camera details can be typed in as easily as an AI label can be deleted.

Metadata becomes strong evidence only when a signature covers it. In a C2PA content credential, the creation details and the digital source type are part of a signed claim, and a hash ties that claim to the pixels.

Common problems

  • "exiftool: command not found": the program is not on your PATH. On Windows, run it from the folder you unpacked it into; on a Mac or Linux, install it from exiftool.org or your package manager.
  • Explorer or Preview shows only a few fields: both show a summary by design. ExifTool lists every group it can read, including XMP and JUMBF, which the built-in viewers leave out.
  • Two different dates for the same moment: many files carry both EXIF and XMP dates, written by different programs. A mismatch is worth noting, and it is common after editing.
  • Dates look an hour or more off: EXIF dates often carry no time zone. Compare them with the offset fields, if present, before reading anything into the gap.
  • A file you edited lost its metadata: the editor did not copy it across. Go back to your untouched copy.

Where metadata sits on the evidence ladder

From strongest to weakest for an image:

  1. Signed content credential with a matching hash: proves the file is unchanged since a named key vouched for it.
  2. Trusted timestamp or signature from the source: proves when, or by whom, a hash was vouched for.
  3. Metadata, including AI labels: shows what the last program recorded. Easy to edit, easy to lose.
  4. Invisible watermarks: show a participating generator marked the image. Silent about other tools.
  5. Visual tells and detector scores: estimates only.

If the metadata is empty or doubtful, keep going down the image verification checklist: look for a watermark, then search for earlier copies of the image.

Sources

Questions

  • Can metadata prove a photo was taken by a real camera?

    No. Camera make, model and settings are plain text fields that any editor, including ExifTool, can write. They are useful as a lead and worthless as proof unless they are covered by a signature, as in a content credential.

  • What does trainedAlgorithmicMedia mean?

    It is the IPTC digital source type for an image created by generative AI. The IPTC vocabulary names it "Created using Generative AI". A related value, compositeWithTrainedAlgorithmicMedia, means "Edited using Generative AI".

  • Why do images from social media have almost no metadata?

    Because most platforms re-encode uploads and drop much of the embedded metadata. An empty result on an image saved from a social site is normal and says nothing about where it came from.

  • Does ExifTool change my file when I read it?

    No. Reading commands such as exiftool -a -u -g1 only print. Writing commands change the file and, by default, keep a copy of the original with "_original" added to its name.

  • Is ExifTool safe to use on Windows and Mac?

    Yes, if you get it from the source. ExifTool is open-source and distributed from exiftool.org for Windows, macOS and other systems. Download it only from that site, and check the published checksum if one is listed.

Related reading