Metadata help

Pmdata · July 21, 2011

To All-

I am working a complex investigation that includes 30 digital photos. Embeded at the end of these images is some metadata that could be important. Any help is greatly appreciated.

Thanks,
Pete

F/W Version: 11.27 Sub: 0116
*CAL: M:18; FF:129; NF:134; NOff:0; FOff:0; FL:0; DPPW:65; DPPB:66;
DPCW:69; DPCB:70; ISO:0; ISO100:0; AFCMS:162; AFNMS:163; AWB:81
*CAL: M:3212; NOff:0; FOff:0; FL:0; ISO:0; ISO100:0; AFCMS:40;
AFNMS:531; AWB_R:6508; AWB_B:6030

*1
*2
*3
*4
*5
*6
*7
*8
*9
*10
*11
*12
*----
----
*a: 2367976 3333
*1
*5000
*0
*0
*58
*282
*100
*14
*128
*2
*b: 295997 3333
*0
*1250
*0
*0
*50
*56
*58
*0
*b1:
*0
*110
*0
*56
*61
*6
*0
*0
*c:
*3
*1
*1
*4
*0
*0
*900
*750
*1948
*0
*c1:
*7
*203
*8
*253
*0
*0
*0
*0 3333
*0
*1875

*0 1 2 3 4 5 6 7
*----
----
*No0.. : 0 0 8 8 4 2 1 1
*No1.. : 1 3 10 7 6 4 1 1
*No2.. : 0 6 9 15 8 1 0 1
*No3.. : 3 5 9 13 6 7 8 9
*No4.. : 4 7 7 11 10 16 16 14
*No5.. : 2 5 7 14 14 14 11 9
*No6.. : 0 0 14 30 22 4 1 9
*No7.. : 1 1 14 25 24 4 0 9
*----
----
*Pr0.. : 47 53 135 196 131 108 95 81
*Pr1.. : 79 103 223 235 235 224 125 127
*Pr2.. : 105 158 213 251 250 211 138 131
*Pr3.. : 185 200 230 252 253 224 207 222
*Pr4.. : 254 255 255 254 255 255 255 255
*Pr5.. : 253 254 254 255 254 254 253 251
*Pr6.. : 204 196 237 255 255 243 198 219
*Pr7.. : 191 188 255 255 255 202 168 239
*----
----
*Use0.. : 0 0 0 0 0 0 0 0
*Use1.. : 0 0 0 0 0 0 0 0
*Use2.. : 0 0 0 0 5 0 0 0
*Use3.. : 0 0 0 0 9 0 0 0
*Use4.. : 0 0 10 6 7 1 0 0
*Use5.. : 0 0 8 4 3 2 0 0
*Use6.. : 0 0 0 0 0 0 0 0
*Use7.. : 0 0 0 0 0 0 0 0
*----
----
*w1.. : 18 13 4 4096 7987 7023 5910 6 0 5 0 57
*w2.. : 0 0 0 0 0 4096 7987 5 1 0 0 0
*w3.. :2367976 0 0 0 0 0 0 0 0 0x9900 0x0 0
*w4.. :6508 6030 6086 5676 -6 -5 0 0

*0 1 2 3 4 5 6 7
*----
----
*W_F0 : 0 0 0 0 0 0 0 0
*W_F1 : 0 0 0 0 0 0 0 0
*W_F2 : 0 0 0 0 0 0 0 0
*W_F3 : 0 0 0 0 0 0 0 0
*W_F4 : 0 0 0 0 0 0 0 0
*W_F5 : 0 0 0 0 0 0 0 0
*W_F6 : 0 0 0 0 0 0 0 0
*W_F7 : 0 0 0 0 0 0 0 0

*0 1 2 3 4 5 6 7
*----
----
*W_PY0 : 10 10 66 35 14 13 13 10
*W_PY1 : 10 10 71 48 42 21 17 13
*W_PY2 : 10 37 59 73 49 12 21 37
*W_PY3 : 10 31 56 79 50 53 80 75
*W_PY4 : 36 49 53 70 65 88 82 71
*W_PY5 : 27 46 50 73 85 69 69 68
*W_PY6 : 7 17 72 117 85 21 77 65
*W_PY7 : 3 5 97 127 105 10 68 61

*0 1 2 3 4 5 6 7
*----
----
*W_P10 : 4 4 24 15 7 6 6 4
*W_P11 : 5 5 27 20 17 9 8 6
*W_P12 : 5 15 23 29 19 6 9 15
*W_P13 : 5 13 20 30 19 20 30 28
*W_P14 : 14 19 20 28 25 34 31 27
*W_P15 : 12 18 20 29 33 26 26 25
*W_P16 : 4 8 25 44 30 9 28 25
*W_P17 : 2 2 32 49 37 5 25 22

*0 1 2 3 4 5 6 7
*----
----
*W_P20 : 3 3 17 9 4 4 4 3
*W_P21 : 3 3 19 12 11 6 5 4
*W_P22 : 3 10 15 19 13 3 6 10
*W_P23 : 3 8 15 21 13 14 22 20
*W_P24 : 10 13 14 18 17 24 22 19
*W_P25 : 7 12 13 19 23 18 18 18
*W_P26 : 2 5 20 38 24 6 21 17
*W_P27 : 1 2 30 45 32 3 18 16

*0 1 2 3 4 5 6 7
*----
----
*W_P30 : 1 1 7 3 1 1 1 1
*W_P31 : 1 1 7 4 3 1 1 1
*W_P32 : 1 3 5 7 4 1 2 3
*W_P33 : 1 3 5 8 5 5 8 8
*W_P34 : 3 4 5 7 6 9 9 7
*W_P35 : 2 4 4 7 9 7 7 7
*W_P36 : 1 1 7 15 9 2 8 6
*W_P37 : 1 1 11 18 13 1 7 6
*----
----

*0 1 2 3 4 5 6 7
*----
----
*W_PLS0 : 255 255 255 255 255 255 255 255
*W_PLS1 : 255 255 255 255 255 255 255 255
*W_PLS2 : 255 255 255 255 255 255 255 255
*W_PLS3 : 255 255 255 255 255 255 255 255
*W_PLS4 : 255 255 255 255 255 255 255 255
*W_PLS5 : 255 255 255 255 255 255 255 255
*W_PLS6 : 255 255 5 5 5 255 255 255
*W_PLS7 : 255 4 5 5 5 255 255 255
*----
----

*0 1 2 3 4 5 6 7
*----
----
*W_PWL0 : 0 0 0 0 0 0 0 0
*W_PWL1 : 0 255 255 255 255 255 255 0
*W_PWL2 : 0 255 255 255 255 255 255 0
*W_PWL3 : 0 255 255 255 255 255 255 0
*W_PWL4 : 0 255 255 255 255 255 255 0
*W_PWL5 : 0 255 255 255 255 255 255 0
*W_PWL6 : 0 255 5 5 5 255 255 0
*W_PWL7 : 0 0 0 0 0 0 0 0
*----
----

*0 1 2 3 4 5 6 7
*----
----
*W_Y20 : 10 10 66 35 14 13 13 10
*W_Y21 : 10 10 71 48 42 21 17 13
*W_Y22 : 10 37 59 73 49 12 21 37
*W_Y23 : 10 31 56 79 50 53 80 75
*W_Y24 : 36 49 53 70 65 88 82 71
*W_Y25 : 27 46 50 73 85 69 69 68
*W_Y26 : 7 17 72 117 85 21 77 65
*W_Y27 : 3 5 97 127 105 10 68 61
*----
----
*LS#[0]: 0
*LS#[1]: 0
*LS#[2]: 0
*LS#[3]: 0
*LS#[4]: 1
*LS#[5]: 6
*----
----
*PWL#[0]: 0
*PWL#[1]: 0
*PWL#[2]: 0
*PWL#[3]: 0
*PWL#[4]: 0
*PWL#[5]: 3
*PWL#[6]: 33
*----
----
*PLO#[0]: 0
*PLO#[1]: 0
*PLO#[2]: 0
*PLO#[3]: 0
*PLO#[4]: 1
*PLO#[5]: 3
*PLO#[6]: 24
*----
----
*Ev_Pre0 :0 1 100 0
*Ev_Pre1 :100 1 100 10000
*Ev_Pre2 :100 1 100 10000
*Ev_Pre3 :100 1 100 10000
*Ev_Pre4 :100 3 100 30000
*Ev_Pre5 :100 24 100 240000
*----
----

*0 1 2 3 4 5 6 7
*----
----
*W_CY0 : 0 0 0 0 0 0 0 0
*W_CY1 : 0 0 0 0 0 0 0 0
*W_CY2 : 0 0 0 0 0 0 0 0
*W_CY3 : 0 0 0 0 0 0 0 0
*W_CY4 : 0 0 0 0 0 0 0 0
*W_CY5 : 0 0 0 0 0 0 0 0
*W_CY6 : 0 0 0 0 0 0 0 0
*W_CY7 : 0 0 0 0 0 0 0 0

*0 1 2 3 4 5 6 7
*----
----
*W_C10 : 4 4 24 15 7 6 6 4
*W_C11 : 5 5 27 20 17 9 8 6
*W_C12 : 5 15 23 29 19 6 9 15
*W_C13 : 5 13 20 30 19 20 30 28
*W_C14 : 14 19 20 28 25 34 31 27
*W_C15 : 12 18 20 29 33 26 26 25
*W_C16 : 4 8 25 44 30 9 28 25
*W_C17 : 2 2 32 49 37 5 25 22

*0 1 2 3 4 5 6 7
*----
----
*W_C20 : 3 3 17 9 4 4 4 3
*W_C21 : 3 3 19 12 11 6 5 4
*W_C22 : 3 10 15 19 13 3 6 10
*W_C23 : 3 8 15 21 13 14 22 20
*W_C24 : 10 13 14 18 17 24 22 19
*W_C25 : 7 12 13 19 23 18 18 18
*W_C26 : 2 5 20 38 24 6 21 17
*W_C27 : 1 2 30 45 32 3 18 16

*0 1 2 3 4 5 6 7
*----
----
*W_C30 : 0 0 7 3 1 1 1 0
*W_C31 : 0 0 7 4 3 1 1 1
*W_C32 : 0 3 5 7 4 1 2 3
*W_C33 : 0 3 5 8 5 5 8 8
*W_C34 : 3 4 5 7 6 9 9 7
*W_C35 : 2 4 4 7 9 7 7 7
*W_C36 : 0 1 7 15 9 2 8 6
*W_C37 : 0 0 11 18 13 1 7 6

*0 1 2 3 4 5 6 7
*----
----
*W_CLS0 : 0 0 0 0 0 0 0 0
*W_CLS1 : 0 0 0 0 0 0 0 0
*W_CLS2 : 0 0 0 0 0 0 0 0
*W_CLS3 : 0 0 0 0 0 0 0 0
*W_CLS4 : 0 0 0 0 0 0 0 0
*W_CLS5 : 0 0 0 0 0 0 0 0
*W_CLS6 : 0 0 0 0 0 0 0 0
*W_CLS7 : 0 0 0 0 0 0 0 0
*----
----

*0 1 2 3 4 5 6 7
*----
----
*W_CWL0 : 0 0 0 0 0 0 0 0
*W_CWL1 : 0 0 0 0 0 0 0 0
*W_CWL2 : 0 0 0 0 0 0 0 0
*W_CWL3 : 0 0 0 0 0 0 0 0
*W_CWL4 : 0 0 0 0 0 0 0 0
*W_CWL5 : 0 0 0 0 0 0 0 0
*W_CWL6 : 0 0 0 0 0 0 0 0
*W_CWL7 : 0 0 0 0 0 0 0 0
*----
----
*CLS#[0]: 0
*CLS#[1]: 0
*CLS#[2]: 0
*CLS#[3]: 0
*CLS#[4]: 0
*CLS#[5]: 0
*----
----
*CWL#[0]: 0
*CWL#[1]: 0
*CWL#[2]: 0
*CWL#[3]: 0
*CWL#[4]: 0
*CWL#[5]: 0
*CWL#[6]: 0
*----
----
*CLO#[0]: 0
*CLO#[1]: 0
*CLO#[2]: 0
*CLO#[3]: 0
*CLO#[4]: 0
*CLO#[5]: 0
*CLO#[6]: 0
*----
----
*Ev_Cap0 :0 0 0 0
*Ev_Cap1 :0 0 0 0
*Ev_Cap2 :0 0 0 0
*Ev_Cap3 :0 0 0 0
*Ev_Cap4 :0 0 0 0
*Ev_Cap5 :0 0 0 0
*----
----
*LA[0]..: 0 0
*LA[1]..: 0 0
*LA[2]..: 0 0
*LA[3]..: 0 0
*LA[4]..: 0 0
*LA[5]..: 0 0
*LA[6]..: 0 0
*LA[7]..: 0 0
*LA[8]..: 0 0
*LA[9]..: 1 0
*LA[10]..: 4 0
*LA[11]..: 2 0
*LA[12]..: 0 0
*LA[13]..: 0 0
*LA[14]..: 9 0
*----
----

*0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
*----
----
*Mshutter: 3212
*ISO: 0
*ISO100Capture: 0
*Far: 1203 1205 1211 1219 1229 1241 1252 1263 1274 1282 1283
*Near: 1226 1231 1244 1265 1289 1321 1353 1386 1416 1437 1443

*0 1 2 3 4 5 6 7 8 9 10
*----
----
*f1.. : 0 1 2 0 0 0 0
*f2.. : 1190 1246 4 5 1208 1208 0 128 0 0 0 0 0

*0 1 2 3 4 5 6 7 8 9 10
*----
----
*Fp.. :1190 1194 1198 1202 1206
*Fv.. :1344 1376 1347 1347 0
*FvC.. :0 0 0 0 0
*FvL.. :0 0 0 0 0
*FvR.. :0 0 0 0 0
*Fcnt.

4 5 6 7

*0 1 2 3 4 5 6 7 8 9 10

BinaryFx · July 22, 2011

A DekeRant can be found here:

http://www.youtube.com/watch?v=19330Kph3wo

OK, enough of the light comedy...

Pete, if you are not in this [digital image forensics] game professionally, I would recommend that you contact somebody who is:

http://forensicphotoshop.blogspot.com/

Over the years I have picked up little things here and there, just enough to respect the pros and to know that this sort of thing is way beyond my knowledge (analysis of the DCT in JPEG compression etc)!

Stephen Marsh

http://binaryfx.customer.netspace.net.au/ (coming soon!)
http://members.ozemail.com.au/~binaryfx/
http://prepression.blogspot.com/

Pmdata · July 22, 2011

Sir,

Thanks for that link. That looks like it will prove useful.

I'm digital forensics professional, but I've never come across metadata like this. I was hoping the pros here might recognize it.

CS5 File Info reveals little EXIF/XML data. And what little it does display seems unrelated to the raw info I pulled from hex displayed below.

PhotoME reveals very little as well.

Any help is appreciated.

Pete

BinaryFx wrote: »

A DekeRant can be found here:

http://www.youtube.com/watch?v=19330Kph3wo

OK, enough of the light comedy...

Pete, if you are not in this [digital image forensics] game professionally, I would recommend that you contact somebody who is:

http://forensicphotoshop.blogspot.com/

Over the years I have picked up little things here and there, just enough to respect the pros and to know that this sort of thing is way beyond my knowledge (analysis of the DCT in JPEG compression etc)!

Stephen Marsh

http://binaryfx.customer.netspace.net.au/ (coming soon!)
http://members.ozemail.com.au/~binaryfx/
http://prepression.blogspot.com/

Dan7312 · July 22, 2011

This exif utility might do a better job decoding the data.

http://www.hugsan.com/EXIFutils/

Dan

Pmdata wrote: »

Sir,

Thanks for that link. That looks like it will prove useful.

I'm digital forensics professional, but I've never come across metadata like this. I was hoping the pros here might recognize it.

CS5 File Info reveals little EXIF/XML data. And what little it does display seems unrelated to the raw info I pulled from hex displayed below.

PhotoME reveals very little as well.

Any help is appreciated.

Pete

Pmdata · July 23, 2011

Thanks Dan. Awesome.

Any maker notes hints. Something buried here that I'm missing.

Camera *
*Description * * * * * * * * * : DIGITAL CAMERA
*Make * * * * * * * * * * * * *: CAMERA * * * * * * * * * * * *
*Model * * * * * * * * * * * * : 5MP-9EY * * * *
*Orientation (start point) * * : 1
*X Resolution * * * * * * * * *: 180/1
*Y Resolution * * * * * * * * *: 180/1
*Resolution Unit * * * * * * * : 2
*Firmware Version * * * * * * *: V1.15P * * * * * *
*Date/Time Modified * * * * * *: 2007:08:14 09:49:49
*YCbCr Positioning * * * * * * : 2

Image * *
*Exposure Time (sec) * * * * * : 10/300
*F-Number * * * * * * * * * * *: 28/10
*Exposure Program * * * * * * *: 2
*ISO Speed * * * * * * * * * * : 100
*EXIF Version * * * * * * * * *: 30323230
*Date/Time Taken * * * * * * * : 2007:08:14 09:49:49
*Date/Time Digitised * * * * * : 2007:08:14 09:49:49
*Components Configuration * * *: 01020300
*Shutter Speed (sec) * * * * * : 491/100
*Aperture * * * * * * * * * * *: 298/100
*Exposure Bias (EV) * * * * * *: 0/10
*Max Aperture * * * * * * * * *: 30/10
*Metering Mode * * * * * * * * : 2
*Light Source * * * * * * * * *: 4
*Flash * * * * * * * * * * * * : 89
*Focal Length (mm) * * * * * * : 58/10
*Maker Note * * * * * * * * * *: 363130010000363701393031323334353637383930313
* * * * * * * * * * * * * * * * *233343536373839303132333435363738393031323334
* * * * * * * * * * * * * * * * *353637383930313233343536373839303132000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000000000000000000000000000000
* * * * * * * * * * * * * * * * *000000000000000000
*FlashPix Version * * * * * * *: 30313030
*Colour Space * * * * * * * * *: 1
*Image Width * * * * * * * * * : 2560
*Image Height * * * * * * * * *: 1920
*Sensing Method * * * * * * * *: 2
*File Source * * * * * * * * * : 03
*Custom Render * * * * * * * * : 0
*Exposure Mode * * * * * * * * : 0
*White Balance * * * * * * * * : 0
*Scene Capture Mode * * * * * *: 0

Thumbnail
*Thumb Compression * * * * * * : 6
*Thumb X Resolution * * * * * *: 180/1
*Thumb Y Resolution * * * * * *: 180/1
*Thumb Resolution Unit * * * * : 2
*Thumb Jpeg IF Offset * * * * *: 35900
*Thumb Jpeg IF Byte Count * * *: 5124

InterOp *
Interop. Index * * * * * * * *: R98
Interop. Version * * * * * * *: 30313030

Dan7312 · July 23, 2011

Maker notes are a bit more difficult to deal with, it's just proprietary data that the camera manufacturer doesn't document. If you have access to the camera that took the pictures you can try taking pictures under different conditions with different settings to see how the maker notes change and you might be able to figure it what info is in them. Also contact the camera manufacturer and maybe they will tell you format of their maker notes.

BinaryFx · July 23, 2011

Pete, if EXIFutility is helping, the try EXIFtool (not sure how this differs from EXIFutility):

http://www.sno.phy.queensu.ca/~phil/exiftool/
http://freeweb.siol.net/hrastni3/foto/exif/exiftoolgui.htm
http://www.proxel.se/exif.html
http://www.photome.de/

Once you start searching for EXIF editors and other appropriate keywords, you will find many other tools that may help.

Regards,

Stephen Marsh

http://binaryfx.customer.netspace.net.au/ (coming soon!)
http://members.ozemail.com.au/~binaryfx/
http://prepression.blogspot.com/

Pmdata · July 23, 2011

Much thanks to you both. I'll keep plugging away.

Pete

BinaryFx · July 23, 2011

While on the general topic, It took me a while to dig through my bookmark archive, however this is a 1hr video on image forensics:

http://video.google.com/videoplay?docid=-6117162361460615788

Best,

Stephen Marsh

http://binaryfx.customer.netspace.net.au/ (coming soon!)
http://members.ozemail.com.au/~binaryfx/
http://prepression.blogspot.com/

Pmdata · July 23, 2011

Thanks Stephen.

Also, looks like we are pointing to a Hyundai camera. However I am unable to come up with makernotes information on thus brand. I'm not even sure it was sold in the US.

The guys at Panasonic etc are top notch when we are looking for help. Hyundai may be a bit more tricky.

Cheers.

Metadata help

Comments