Lion Cipher Lab

Parse JPEG Exif by hand and test a photo's timeline claims

• Digital Forensics & IR (DFIR)
• Intermediate
• ~75 min
• Free · no account required

Why it matters

Photos turn up in investigations constantly: the screenshot attached to a phishing report, the picture of a propped-open server-room door, the image in a fraud claim, the photo an insider says proves where they were. Each one carries Exif metadata — the camera's own record of when, where and with what it was taken — and each one invites a quick, confident reading that is often wrong. The time most viewers show you is the time the file was last changed, not when the picture was taken. The capture time is local clock time with no time zone unless the camera wrote a separate offset tag. Phone…

What you'll learn

• Walking a JPEG's marker segments to find the Exif APP1 segment
• Reading a TIFF header and IFD entries in both byte orders (II little-endian and MM big-endian)
• Following the Exif IFD (0x8769) and GPS IFD (0x8825) pointers to the tags investigators actually use
• Telling DateTime (file changed) from DateTimeOriginal (picture taken) from the filesystem mtime
• Converting a local capture time to UTC with OffsetTimeOriginal, and recognizing when that is impossible
• Using GPSTimeStamp as a UTC anchor to measure a camera clock's drift
• Testing a time-and-place claim against photo metadata and writing an honest consistent / inconsistent / undetermined verdict

Steps in this lab

1. What Exif is, and why you will read it byte by byte
2. The map: JPEG segments, the APP1 box, and a little TIFF file inside it
3. Build six evidence photos with hand-written Exif
4. Read the raw bytes before any parser touches them
5. Write the parser: walk the segments, read the IFDs, follow the pointers
6. Three clocks in one photo, and only one of them has a time zone
7. Test the claim against all six photos
8. Read the verdicts like an investigator, not a scoreboard
9. Honest limits: you forged every one of these tags yourself
10. Check your parser against the reference tool, and where to go next

Open the full interactive lab →