Forensic Value of Exif Data: An Analytical Evaluation of Metadata Integrity across Image Transfer Methods

Exif metadata contained in digital photographs is an important forensic resource, offering authentic information like timestamps, geolocation, and device identifiers. The research assesses the integrity of Exif information on various methods of image transmission, such as USB, email, and messaging platforms like WhatsApp, Telegram, Signal, Instagram, Facebook Messenger, and Snapchat. With the controlled image dataset of Android, iOS phones, and the Flickr Creative Commons collection, we examined metadata preservation using forensic software (Magnet AXIOM, FTK, XRY, ExifTool). Document-based modes and direct transfers (USB, email) maintained all Exif fields and file hashes, providing forensic integrity. Chat/image-based transfers, fueled by compression, effectively remove metadata, changing the file integrity. These results emphasize the necessity of platform-aware evidence handling in order to preserve metadata integrity during digital forensic examinations.