Analysis of errors in exif metadata on mobile devices

Nowadays the number of cameras integrated in mobile phones is growing very fast, making it essential to design new specific forensic analysis techniques aimed towards the pictures created with these devices. Most of these phones automatically add relevant Exif metadata in the process of image acquisition. This metadata, even if it is vulnerable to tampering, can be very helpful for a variety of forensic analysis techniques. That is why the existence of efficient, robust and specialized tools is a necessity. These should allow metadata to be extracted in a consistent, fast and sound way. Besides, metadata extraction must never manipulate the image and it needs to take into account possible departures from the Exif specification, including the insertion of the metadata in the image acquisition process by the makers, as well as any modification, whether malicious or not. This paper will show the multiple anomalies in the Exif specification we have found during our study, which can produce serious problems in classical tools for the extraction of image metadata, including crashes and wrong results, and even interoperability problems among different devices. We will also show some anomalies found in the operation of different well-known forensic tools.